NetworkPkg/Application/IpsecConfig/IpSecConfig.c

   1 /** @file
   2   The main process for IpSecConfig application.
   3
   4   Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>
   5
   6   This program and the accompanying materials
   7   are licensed and made available under the terms and conditions of the BSD License
   8   which accompanies this distribution.  The full text of the license may be found at
   9   http://opensource.org/licenses/bsd-license.php.
  10
  11   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  12   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  13
  14 **/
  15
  16 #include <Library/UefiRuntimeServicesTableLib.h>
  17 #include <Library/HiiLib.h>
  18
  19 #include <Protocol/IpSec.h>
  20
  21 #include "IpSecConfig.h"
  22 #include "Dump.h"
  23 #include "Indexer.h"
  24 #include "PolicyEntryOperation.h"
  25 #include "Delete.h"
  26 #include "Helper.h"
  27
  28 //
  29 // Used for ShellCommandLineParseEx only
  30 // and to ensure user inputs are in valid format
  31 //
  32 SHELL_PARAM_ITEM    mIpSecConfigParamList[] = {
  33   { L"-p",                    TypeValue },
  34   { L"-a",                    TypeValue },
  35   { L"-i",                    TypeValue },
  36   { L"-e",                    TypeValue },
  37   { L"-d",                    TypeValue },
  38   { L"-f",                    TypeFlag },
  39   { L"-l",                    TypeFlag },
  40   { L"-enable",               TypeFlag },
  41   { L"-disable",              TypeFlag },
  42   { L"-status",               TypeFlag },
  43   { L"-?",                    TypeFlag },
  44
  45   //
  46   // SPD Selector
  47   //
  48   { L"--local",               TypeValue },
  49   { L"--remote",              TypeValue },
  50   { L"--proto",               TypeValue },
  51   { L"--local-port",          TypeValue },
  52   { L"--remote-port",         TypeValue },
  53   { L"--icmp-type",           TypeValue },
  54   { L"--icmp-code",           TypeValue },
  55
  56   //
  57   // SPD Data
  58   //
  59   { L"--name",                TypeValue },
  60   { L"--packet-flag",         TypeValue },
  61   { L"--action",              TypeValue },
  62   { L"--lifebyte",            TypeValue },
  63   { L"--lifetime-soft",       TypeValue },
  64   { L"--lifetime",            TypeValue },
  65   { L"--mode",                TypeValue },
  66   { L"--tunnel-local",        TypeValue },
  67   { L"--tunnel-remote",       TypeValue },
  68   { L"--dont-fragment",       TypeValue },
  69   { L"--ipsec-proto",         TypeValue },
  70   { L"--auth-algo",           TypeValue },
  71   { L"--encrypt-algo",        TypeValue },
  72
  73   { L"--ext-sequence",        TypeFlag  },
  74   { L"--sequence-overflow",   TypeFlag  },
  75   { L"--fragment-check",      TypeFlag  },
  76   { L"--ext-sequence-",       TypeFlag  },
  77   { L"--sequence-overflow-",  TypeFlag  },
  78   { L"--fragment-check-",     TypeFlag  },
  79
  80   //
  81   // SA ID
  82   // --ipsec-proto
  83   //
  84   { L"--spi",                 TypeValue },
  85   { L"--tunnel-dest",         TypeValue },
  86   { L"--tunnel-source",       TypeValue },
  87   { L"--lookup-spi",          TypeValue },
  88   { L"--lookup-ipsec-proto",  TypeValue },
  89   { L"--lookup-dest",         TypeValue },
  90
  91   //
  92   // SA DATA
  93   // --mode
  94   // --auth-algo
  95   // --encrypt-algo
  96   //
  97   { L"--sequence-number",     TypeValue },
  98   { L"--antireplay-window",   TypeValue },
  99   { L"--auth-key",            TypeValue },
 100   { L"--encrypt-key",         TypeValue },
 101   { L"--path-mtu",            TypeValue },
 102
 103   //
 104   // PAD ID
 105   //
 106   { L"--peer-id",             TypeValue },
 107   { L"--peer-address",        TypeValue },
 108   { L"--auth-proto",          TypeValue },
 109   { L"--auth-method",         TypeValue },
 110   { L"--ike-id",              TypeValue },
 111   { L"--ike-id-",             TypeValue },
 112   { L"--auth-data",           TypeValue },
 113   { L"--revocation-data",     TypeValue },
 114   { L"--lookup-peer-id",      TypeValue },
 115   { L"--lookup-peer-address", TypeValue },
 116
 117   { NULL,                     TypeMax   },
 118 };
 119
 120 //
 121 // -P
 122 //
 123 STR2INT mMapPolicy[] = {
 124   { L"SPD",       IPsecConfigDataTypeSpd },
 125   { L"SAD",       IPsecConfigDataTypeSad },
 126   { L"PAD",       IPsecConfigDataTypePad },
 127   { NULL,         0 },
 128 };
 129
 130 //
 131 // --proto
 132 //
 133 STR2INT mMapIpProtocol[] = {
 134   { L"TCP",       EFI_IP4_PROTO_TCP },
 135   { L"UDP",       EFI_IP4_PROTO_UDP },
 136   { L"ICMP",      EFI_IP4_PROTO_ICMP },
 137   { NULL,         0 },
 138 };
 139
 140 //
 141 // --action
 142 //
 143 STR2INT mMapIpSecAction[] = {
 144   { L"Bypass",    EfiIPsecActionBypass },
 145   { L"Discard",   EfiIPsecActionDiscard },
 146   { L"Protect",   EfiIPsecActionProtect },
 147   { NULL,         0 },
 148 };
 149
 150 //
 151 // --mode
 152 //
 153 STR2INT mMapIpSecMode[] = {
 154   { L"Transport", EfiIPsecTransport },
 155   { L"Tunnel",    EfiIPsecTunnel },
 156   { NULL,         0 },
 157 };
 158
 159 //
 160 // --dont-fragment
 161 //
 162 STR2INT mMapDfOption[] = {
 163   { L"clear",     EfiIPsecTunnelClearDf },
 164   { L"set",       EfiIPsecTunnelSetDf },
 165   { L"copy",      EfiIPsecTunnelCopyDf },
 166   { NULL,         0 },
 167 };
 168
 169 //
 170 // --ipsec-proto
 171 //
 172 STR2INT mMapIpSecProtocol[] = {
 173   { L"AH",        EfiIPsecAH },
 174   { L"ESP",       EfiIPsecESP },
 175   { NULL,         0 },
 176 };
 177
 178 //
 179 // --auth-algo
 180 //
 181 STR2INT mMapAuthAlgo[] = {
 182   { L"NONE",         IPSEC_AALG_NONE },
 183   { L"MD5HMAC",      IPSEC_AALG_MD5HMAC },
 184   { L"SHA1HMAC",     IPSEC_AALG_SHA1HMAC },
 185   { L"SHA2-256HMAC", IPSEC_AALG_SHA2_256HMAC },
 186   { L"SHA2-384HMAC", IPSEC_AALG_SHA2_384HMAC },
 187   { L"SHA2-512HMAC", IPSEC_AALG_SHA2_512HMAC },
 188   { L"AES-XCBC-MAC", IPSEC_AALG_AES_XCBC_MAC },
 189   { L"NULL",         IPSEC_AALG_NULL },
 190   { NULL,            0 },
 191 };
 192
 193 //
 194 // --encrypt-algo
 195 //
 196 STR2INT mMapEncAlgo[] = {
 197   { L"NONE",         IPSEC_EALG_NONE },
 198   { L"DESCBC",       IPSEC_EALG_DESCBC },
 199   { L"3DESCBC",      IPSEC_EALG_3DESCBC },
 200   { L"CASTCBC",      IPSEC_EALG_CASTCBC },
 201   { L"BLOWFISHCBC",  IPSEC_EALG_BLOWFISHCBC },
 202   { L"NULL",         IPSEC_EALG_NULL },
 203   { L"AESCBC",       IPSEC_EALG_AESCBC },
 204   { L"AESCTR",       IPSEC_EALG_AESCTR },
 205   { L"AES-CCM-ICV8", IPSEC_EALG_AES_CCM_ICV8 },
 206   { L"AES-CCM-ICV12",IPSEC_EALG_AES_CCM_ICV12 },
 207   { L"AES-CCM-ICV16",IPSEC_EALG_AES_CCM_ICV16 },
 208   { L"AES-GCM-ICV8", IPSEC_EALG_AES_GCM_ICV8 },
 209   { L"AES-GCM-ICV12",IPSEC_EALG_AES_GCM_ICV12 },
 210   { L"AES-GCM-ICV16",IPSEC_EALG_AES_GCM_ICV16 },
 211   { NULL,            0 },
 212 };
 213
 214 //
 215 // --auth-proto
 216 //
 217 STR2INT mMapAuthProto[] = {
 218   { L"IKEv1",        EfiIPsecAuthProtocolIKEv1 },
 219   { L"IKEv2",        EfiIPsecAuthProtocolIKEv2 },
 220   { NULL,            0 },
 221 };
 222
 223 //
 224 // --auth-method
 225 //
 226 STR2INT mMapAuthMethod[] = {
 227   { L"PreSharedSecret", EfiIPsecAuthMethodPreSharedSecret },
 228   { L"Certificates",    EfiIPsecAuthMethodCertificates },
 229   { NULL,               0 },
 230 };
 231
 232 EFI_IPSEC2_PROTOCOL          *mIpSec;
 233 EFI_IPSEC_CONFIG_PROTOCOL    *mIpSecConfig;
 234 EFI_HII_HANDLE               mHiiHandle;
 235 CHAR16                       mAppName[]          = L"IpSecConfig";
 236
 237 //
 238 // Used for IpSecConfigRetriveCheckListByName only to check the validation of user input
 239 //
 240 VAR_CHECK_ITEM    mIpSecConfigVarCheckList[] = {
 241   { L"-enable",              BIT(1)|BIT(0),  BIT(1),  BIT(2)|BIT(1)|BIT(0), 0 },
 242   { L"-disable",             BIT(1)|BIT(0),  BIT(1),  BIT(2)|BIT(1)|BIT(0), 0 },
 243   { L"-status",              BIT(1)|BIT(0),  BIT(1),  BIT(2)|BIT(1)|BIT(0), 0 },
 244   { L"-p",                   BIT(1),         0,       BIT(2)|BIT(1)|BIT(0), 0 },
 245
 246   { L"-a",                   BIT(0),         0,       BIT(2)|BIT(1)|BIT(0), 0 },
 247   { L"-i",                   BIT(0),         0,       BIT(2)|BIT(1)|BIT(0), 0 },
 248   { L"-d",                   BIT(0),         0,       BIT(2)|BIT(1)|BIT(0), 0 },
 249   { L"-e",                   BIT(0),         0,       BIT(2)|BIT(1)|BIT(0), 0 },
 250   { L"-l",                   BIT(0),         0,       BIT(2)|BIT(1)|BIT(0), 0 },
 251   { L"-f",                   BIT(0),         0,       BIT(2)|BIT(1)|BIT(0), 0 },
 252
 253   { L"-?",                   BIT(0),         BIT(0),  BIT(2)|BIT(1)|BIT(0), 0 },
 254
 255   //
 256   // SPD Selector
 257   //
 258   { L"--local",              0,              0,       BIT(2)|BIT(1),        0 },
 259   { L"--remote",             0,              0,       BIT(2)|BIT(1),        0 },
 260   { L"--proto",              0,              0,       BIT(2)|BIT(1),        0 },
 261   { L"--local-port",         0,              0,       BIT(2)|BIT(1),        BIT(0) },
 262   { L"--remote-port",        0,              0,       BIT(2)|BIT(1),        BIT(0) },
 263   { L"--icmp-type",          0,              0,       BIT(2)|BIT(1),        BIT(1) },
 264   { L"--icmp-code",          0,              0,       BIT(2)|BIT(1),        BIT(1) },
 265
 266   //
 267   // SPD Data
 268   //
 269   { L"--name",               0,              0,       BIT(2),               0 },
 270   { L"--packet-flag",        0,              0,       BIT(2),               0 },
 271   { L"--action",             0,              0,       BIT(2)|BIT(1),        0 },
 272   { L"--lifebyte",           0,              0,       BIT(2)|BIT(1),        0 },
 273   { L"--lifetime-soft",      0,              0,       BIT(2)|BIT(1),        0 },
 274   { L"--lifetime",           0,              0,       BIT(2)|BIT(1),        0 },
 275   { L"--mode",               0,              0,       BIT(2)|BIT(1),        0 },
 276   { L"--tunnel-local",       0,              0,       BIT(2),               0 },
 277   { L"--tunnel-remote",      0,              0,       BIT(2),               0 },
 278   { L"--dont-fragment",      0,              0,       BIT(2),               0 },
 279   { L"--ipsec-proto",        0,              0,       BIT(2)|BIT(1),        0 },
 280   { L"--auth-algo",          0,              0,       BIT(2)|BIT(1),        0 },
 281   { L"--encrypt-algo",       0,              0,       BIT(2)|BIT(1),        0 },
 282
 283   { L"--ext-sequence",       0,              0,       BIT(2),               BIT(2) },
 284   { L"--sequence-overflow",  0,              0,       BIT(2),               BIT(2) },
 285   { L"--fragment-check",     0,              0,       BIT(2),               BIT(2) },
 286   { L"--ext-sequence-",      0,              0,       BIT(2),               BIT(3) },
 287   { L"--sequence-overflow-", 0,              0,       BIT(2),               BIT(3) },
 288   { L"--fragment-check-",    0,              0,       BIT(2),               BIT(3) },
 289
 290   //
 291   // SA ID
 292   // --ipsec-proto
 293   //
 294   { L"--spi",                0,              0,       BIT(1),               0 },
 295   { L"--tunnel-dest",        0,              0,       BIT(1),               0 },
 296   { L"--tunnel-source",      0,              0,       BIT(1),               0 },
 297   { L"--lookup-spi",         0,              0,       BIT(1),               0 },
 298   { L"--lookup-ipsec-proto", 0,              0,       BIT(1),               0 },
 299   { L"--lookup-dest",        0,              0,       BIT(1),               0 },
 300
 301   //
 302   // SA DATA
 303   // --mode
 304   // --auth-algo
 305   // --encrypt-algo
 306   //
 307   { L"--sequence-number",    0,              0,       BIT(1),               0 },
 308   { L"--antireplay-window",  0,              0,       BIT(1),               0 },
 309   { L"--auth-key",           0,              0,       BIT(1),               0 },
 310   { L"--encrypt-key",        0,              0,       BIT(1),               0 },
 311   { L"--path-mtu",           0,              0,       BIT(1),               0 },
 312
 313   //
 314   // The example to add a PAD:
 315   // "-A --peer-id Mike [--peer-address 10.23.2.2] --auth-proto IKE1/IKE2
 316   //     --auth-method PreSharedSeceret/Certificate --ike-id
 317   //     --auth-data 343343 --revocation-data 2342432"
 318   // The example to delete a PAD:
 319   // "-D * --lookup-peer-id Mike [--lookup-peer-address 10.23.2.2]"
 320   // "-D 1"
 321   // The example to edit a PAD:
 322   // "-E * --lookup-peer-id Mike --auth-method Certificate"
 323
 324   //
 325   // PAD ID
 326   //
 327   { L"--peer-id",            0,              0,       BIT(0),               BIT(4) },
 328   { L"--peer-address",       0,              0,       BIT(0),               BIT(5) },
 329   { L"--auth-proto",         0,              0,       BIT(0),               0 },
 330   { L"--auth-method",        0,              0,       BIT(0),               0 },
 331   { L"--IKE-ID",             0,              0,       BIT(0),               BIT(6) },
 332   { L"--IKE-ID-",            0,              0,       BIT(0),               BIT(7) },
 333   { L"--auth-data",          0,              0,       BIT(0),               0 },
 334   { L"--revocation-data",    0,              0,       BIT(0),               0 },
 335   { L"--lookup-peer-id",     0,              0,       BIT(0),               BIT(4) },
 336   { L"--lookup-peer-address",0,              0,       BIT(0),               BIT(5) },
 337
 338   { NULL,                    0,              0,       0,                    0 },
 339 };
 340
 341 /**
 342   The function to allocate the proper sized buffer for various
 343   EFI interfaces.
 344
 345   @param[in, out] Status        Current status.
 346   @param[in, out] Buffer        Current allocated buffer, or NULL.
 347   @param[in]      BufferSize    Current buffer size needed
 348
 349   @retval TRUE     If the buffer was reallocated and the caller should try the API again.
 350   @retval FALSE    If the buffer was not reallocated successfully.
 351 **/
 352 BOOLEAN
 353 GrowBuffer (
 354   IN OUT EFI_STATUS    *Status,
 355   IN OUT VOID          **Buffer,
 356   IN     UINTN         BufferSize
 357   )
 358 {
 359   BOOLEAN    TryAgain;
 360
 361   ASSERT (Status != NULL);
 362   ASSERT (Buffer != NULL);
 363
 364   //
 365   // If this is an initial request, buffer will be null with a new buffer size.
 366   //
 367   if ((NULL == *Buffer) && (BufferSize != 0)) {
 368     *Status = EFI_BUFFER_TOO_SMALL;
 369   }
 370
 371   //
 372   // If the status code is "buffer too small", resize the buffer.
 373   //
 374   TryAgain = FALSE;
 375   if (*Status == EFI_BUFFER_TOO_SMALL) {
 376
 377     if (*Buffer != NULL) {
 378       FreePool (*Buffer);
 379     }
 380
 381     *Buffer = AllocateZeroPool (BufferSize);
 382
 383     if (*Buffer != NULL) {
 384       TryAgain = TRUE;
 385     } else {
 386       *Status = EFI_OUT_OF_RESOURCES;
 387     }
 388   }
 389
 390   //
 391   // If there's an error, free the buffer.
 392   //
 393   if (!TryAgain && EFI_ERROR (*Status) && (*Buffer != NULL)) {
 394     FreePool (*Buffer);
 395     *Buffer = NULL;
 396   }
 397
 398   return TryAgain;
 399 }
 400
 401 /**
 402   Function returns an array of handles that support the requested protocol
 403   in a buffer allocated from a pool.
 404
 405   @param[in]      SearchType    Specifies which handle(s) are to be returned.
 406   @param[in]      Protocol      Provides the protocol to search by.
 407                                 This parameter is only valid for SearchType ByProtocol.
 408
 409   @param[in]      SearchKey     Supplies the search key depending on the SearchType.
 410   @param[in, out] NoHandles     The number of handles returned in Buffer.
 411   @param[out]     Buffer        A pointer to the buffer to return the requested array of
 412                                 handles that support Protocol.
 413
 414   @retval EFI_SUCCESS    The resulting array of handles was returned.
 415   @retval Others         Other mistake case.
 416 **/
 417 EFI_STATUS
 418 LocateHandle (
 419   IN     EFI_LOCATE_SEARCH_TYPE    SearchType,
 420   IN     EFI_GUID                  *Protocol  OPTIONAL,
 421   IN     VOID                      *SearchKey OPTIONAL,
 422   IN OUT UINTN                     *NoHandles,
 423      OUT EFI_HANDLE                **Buffer
 424   )
 425 {
 426   EFI_STATUS    Status;
 427   UINTN         BufferSize;
 428
 429   ASSERT (NoHandles != NULL);
 430   ASSERT (Buffer != NULL);
 431
 432   //
 433   // Initialize for GrowBuffer loop.
 434   //
 435   Status      = EFI_SUCCESS;
 436   *Buffer     = NULL;
 437   BufferSize  = 50 * sizeof (EFI_HANDLE);
 438
 439   //
 440   // Call the real function.
 441   //
 442   while (GrowBuffer (&Status, (VOID **) Buffer, BufferSize)) {
 443     Status = gBS->LocateHandle (
 444                     SearchType,
 445                     Protocol,
 446                     SearchKey,
 447                     &BufferSize,
 448                     *Buffer
 449                     );
 450   }
 451
 452   *NoHandles = BufferSize / sizeof (EFI_HANDLE);
 453   if (EFI_ERROR (Status)) {
 454     *NoHandles = 0;
 455   }
 456
 457   return Status;
 458 }
 459
 460 /**
 461   Find the first instance of this protocol in the system and return its interface.
 462
 463   @param[in]  ProtocolGuid    The guid of the protocol.
 464   @param[out] Interface       The pointer to the first instance of the protocol.
 465
 466   @retval EFI_SUCCESS    A protocol instance matching ProtocolGuid was found.
 467   @retval Others         A protocol instance matching ProtocolGuid was not found.
 468 **/
 469 EFI_STATUS
 470 LocateProtocol (
 471   IN  EFI_GUID    *ProtocolGuid,
 472   OUT VOID        **Interface
 473   )
 474
 475 {
 476   EFI_STATUS    Status;
 477   UINTN         NumberHandles;
 478   UINTN         Index;
 479   EFI_HANDLE    *Handles;
 480
 481   *Interface    = NULL;
 482   Handles       = NULL;
 483   NumberHandles = 0;
 484
 485   Status        = LocateHandle (ByProtocol, ProtocolGuid, NULL, &NumberHandles, &Handles);
 486   if (EFI_ERROR (Status)) {
 487     DEBUG ((EFI_D_INFO, "LibLocateProtocol: Handle not found\n"));
 488     return Status;
 489   }
 490
 491   for (Index = 0; Index < NumberHandles; Index++) {
 492     ASSERT (Handles != NULL);
 493     Status = gBS->HandleProtocol (
 494                     Handles[Index],
 495                     ProtocolGuid,
 496                     Interface
 497                     );
 498
 499     if (!EFI_ERROR (Status)) {
 500       break;
 501     }
 502   }
 503
 504   if (Handles != NULL) {
 505     FreePool (Handles);
 506   }
 507
 508   return Status;
 509 }
 510
 511 /**
 512   Helper function called to check the conflicted flags.
 513
 514   @param[in] CheckList       The pointer to the VAR_CHECK_ITEM table.
 515   @param[in] ParamPackage    The pointer to the ParamPackage list.
 516
 517   @retval EFI_SUCCESS              No conflicted flags.
 518   @retval EFI_INVALID_PARAMETER    The input parameter is erroroneous or there are some conflicted flags.
 519 **/
 520 EFI_STATUS
 521 IpSecConfigRetriveCheckListByName (
 522   IN VAR_CHECK_ITEM    *CheckList,
 523   IN LIST_ENTRY        *ParamPackage
 524 )
 525 {
 526
 527   LIST_ENTRY        *Node;
 528   VAR_CHECK_ITEM    *Item;
 529   UINT32            Attribute1;
 530   UINT32            Attribute2;
 531   UINT32            Attribute3;
 532   UINT32            Attribute4;
 533   UINT32            Index;
 534
 535   Attribute1 = 0;
 536   Attribute2 = 0;
 537   Attribute3 = 0;
 538   Attribute4 = 0;
 539   Index      = 0;
 540   Item       = mIpSecConfigVarCheckList;
 541
 542   if ((ParamPackage == NULL) || (CheckList == NULL)) {
 543     return EFI_INVALID_PARAMETER;
 544   }
 545
 546   //
 547   // Enumerate through the list of parameters that are input by user.
 548   //
 549   for (Node = GetFirstNode (ParamPackage); !IsNull (ParamPackage, Node); Node = GetNextNode (ParamPackage, Node)) {
 550     if (((SHELL_PARAM_PACKAGE *) Node)->Name != NULL) {
 551       //
 552       // Enumerate the check list that defines the conflicted attributes of each flag.
 553       //
 554       for (; Item->VarName != NULL; Item++) {
 555         if (StrCmp (((SHELL_PARAM_PACKAGE *) Node)->Name, Item->VarName) == 0) {
 556           Index++;
 557           if (Index == 1) {
 558             Attribute1 = Item->Attribute1;
 559             Attribute2 = Item->Attribute2;
 560             Attribute3 = Item->Attribute3;
 561             Attribute4 = Item->Attribute4;
 562           } else {
 563             Attribute1 &= Item->Attribute1;
 564             Attribute2 |= Item->Attribute2;
 565             Attribute3 &= Item->Attribute3;
 566             Attribute4 |= Item->Attribute4;
 567             if (Attribute1 != 0) {
 568               return EFI_INVALID_PARAMETER;
 569             }
 570
 571             if (Attribute2 != 0) {
 572               if ((Index == 2) && (StrCmp (Item->VarName, L"-p") == 0)) {
 573                 continue;
 574               }
 575
 576               return EFI_INVALID_PARAMETER;
 577             }
 578
 579             if (Attribute3 == 0) {
 580               return EFI_INVALID_PARAMETER;
 581             }
 582             if (((Attribute4 & 0xFF) == 0x03) || ((Attribute4 & 0xFF) == 0x0C) ||
 583                 ((Attribute4 & 0xFF) == 0x30) || ((Attribute4 & 0xFF) == 0xC0)) {
 584               return EFI_INVALID_PARAMETER;
 585             }
 586           }
 587           break;
 588         }
 589       }
 590
 591       Item = mIpSecConfigVarCheckList;
 592     }
 593   }
 594
 595   return EFI_SUCCESS;
 596 }
 597
 598 /**
 599   This is the declaration of an EFI image entry point. This entry point is
 600   the same for UEFI Applications, UEFI OS Loaders, and UEFI Drivers, including
 601   both device drivers and bus drivers.
 602
 603   The entry point for IpSecConfig application that parse the command line input and call an IpSecConfig process.
 604
 605   @param[in] ImageHandle    The image handle of this application.
 606   @param[in] SystemTable    The pointer to the EFI System Table.
 607
 608   @retval EFI_SUCCESS    The operation completed successfully.
 609
 610 **/
 611 EFI_STATUS
 612 EFIAPI
 613 InitializeIpSecConfig (
 614   IN EFI_HANDLE          ImageHandle,
 615   IN EFI_SYSTEM_TABLE    *SystemTable
 616   )
 617 {
 618   EFI_STATUS                    Status;
 619   EFI_IPSEC_CONFIG_DATA_TYPE    DataType;
 620   UINT8                         Value;
 621   LIST_ENTRY                    *ParamPackage;
 622   CONST CHAR16                  *ValueStr;
 623   CHAR16                        *ProblemParam;
 624   UINTN                         NonOptionCount;
 625
 626   //
 627   // Register our string package with HII and return the handle to it.
 628   //
 629   mHiiHandle = HiiAddPackages (&gEfiCallerIdGuid, ImageHandle, IpSecConfigStrings, NULL);
 630   ASSERT (mHiiHandle != NULL);
 631
 632   Status = ShellCommandLineParseEx (mIpSecConfigParamList, &ParamPackage, &ProblemParam, TRUE, FALSE);
 633   if (EFI_ERROR (Status)) {
 634     ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_UNKNOWN_OPERATION), mHiiHandle, ProblemParam);
 635     goto Done;
 636   }
 637
 638   Status = IpSecConfigRetriveCheckListByName (mIpSecConfigVarCheckList, ParamPackage);
 639   if (EFI_ERROR (Status)) {
 640     ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_MISTAKEN_OPTIONS), mHiiHandle);
 641     goto Done;
 642   }
 643
 644   Status = LocateProtocol (&gEfiIpSecConfigProtocolGuid, (VOID **) &mIpSecConfig);
 645   if (EFI_ERROR (Status) || mIpSecConfig == NULL) {
 646     ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_PROTOCOL_INEXISTENT), mHiiHandle, mAppName);
 647     goto Done;
 648   }
 649
 650   Status = LocateProtocol (&gEfiIpSec2ProtocolGuid, (VOID **) &mIpSec);
 651   if (EFI_ERROR (Status) || mIpSec == NULL) {
 652     ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_PROTOCOL_INEXISTENT), mHiiHandle, mAppName);
 653     goto Done;
 654   }
 655
 656   //
 657   // Enable IPsec.
 658   //
 659   if (ShellCommandLineGetFlag (ParamPackage, L"-enable")) {
 660     if (!(mIpSec->DisabledFlag)) {
 661       ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_ALREADY_ENABLE), mHiiHandle, mAppName);
 662     } else {
 663       //
 664       // Set enable flag.
 665       //
 666       Value  = IPSEC_STATUS_ENABLED;
 667       Status = gRT->SetVariable (
 668                       IPSECCONFIG_STATUS_NAME,
 669                       &gEfiIpSecConfigProtocolGuid,
 670                       EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_NON_VOLATILE,
 671                       sizeof (Value),
 672                       &Value
 673                       );
 674       if (!EFI_ERROR (Status)) {
 675         mIpSec->DisabledFlag = FALSE;
 676         ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_ENABLE_SUCCESS), mHiiHandle, mAppName);
 677       } else {
 678         ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_ENABLE_FAILED), mHiiHandle, mAppName);
 679       }
 680     }
 681
 682     goto Done;
 683   }
 684
 685   //
 686   // Disable IPsec.
 687   //
 688   if (ShellCommandLineGetFlag (ParamPackage, L"-disable")) {
 689     if (mIpSec->DisabledFlag) {
 690       ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_ALREADY_DISABLE), mHiiHandle, mAppName);
 691     } else {
 692       //
 693       // Set disable flag; however, leave it to be disabled in the callback function of DisabledEvent.
 694       //
 695       gBS->SignalEvent (mIpSec->DisabledEvent);
 696       if (mIpSec->DisabledFlag) {
 697         ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_DISABLE_SUCCESS), mHiiHandle, mAppName);
 698       } else {
 699         ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_DISABLE_FAILED), mHiiHandle, mAppName);
 700       }
 701     }
 702
 703     goto Done;
 704   }
 705
 706   //
 707   //IPsec Status.
 708   //
 709   if (ShellCommandLineGetFlag (ParamPackage, L"-status")) {
 710     if (mIpSec->DisabledFlag) {
 711       ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_STATUS_DISABLE), mHiiHandle, mAppName);
 712     } else {
 713       ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_STATUS_ENABLE), mHiiHandle, mAppName);
 714     }
 715     goto Done;
 716   }
 717
 718   //
 719   // Try to get policy database type.
 720   //
 721   DataType = (EFI_IPSEC_CONFIG_DATA_TYPE) - 1;
 722   ValueStr = ShellCommandLineGetValue (ParamPackage, L"-p");
 723   if (ValueStr != NULL) {
 724     DataType = (EFI_IPSEC_CONFIG_DATA_TYPE) MapStringToInteger (ValueStr, mMapPolicy);
 725     if (DataType == -1) {
 726       ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_INCORRECT_DB), mHiiHandle, mAppName, ValueStr);
 727       goto Done;
 728     }
 729   }
 730
 731   if (ShellCommandLineGetFlag (ParamPackage, L"-?")) {
 732     if (DataType == -1) {
 733       ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_HELP), mHiiHandle);
 734       goto Done;
 735     }
 736
 737     switch (DataType) {
 738       case IPsecConfigDataTypeSpd:
 739         ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_SPD_HELP), mHiiHandle);
 740         break;
 741
 742       case IPsecConfigDataTypeSad:
 743         ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_SAD_HELP), mHiiHandle);
 744         break;
 745
 746       case IPsecConfigDataTypePad:
 747         ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_PAD_HELP), mHiiHandle);
 748         break;
 749
 750       default:
 751         ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_INCORRECT_DB), mHiiHandle);
 752         break;
 753     }
 754
 755     goto Done;
 756   }
 757
 758   NonOptionCount = ShellCommandLineGetCount (ParamPackage);
 759   if ((NonOptionCount - 1) > 0) {
 760     ValueStr = ShellCommandLineGetRawValue (ParamPackage, (UINT32) (NonOptionCount - 1));
 761     ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_REDUNDANCY_MANY), mHiiHandle, mAppName, ValueStr);
 762     goto Done;
 763   }
 764
 765   if (DataType == -1) {
 766     ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_DB), mHiiHandle, mAppName);
 767     goto Done;
 768   }
 769
 770   if (ShellCommandLineGetFlag (ParamPackage, L"-a")) {
 771     Status = AddOrInsertPolicyEntry (DataType, ParamPackage);
 772     if (EFI_ERROR (Status)) {
 773       goto Done;
 774     }
 775   } else if (ShellCommandLineGetFlag (ParamPackage, L"-i")) {
 776     Status = AddOrInsertPolicyEntry (DataType, ParamPackage);
 777     if (EFI_ERROR (Status)) {
 778       goto Done;
 779     }
 780   } else if (ShellCommandLineGetFlag (ParamPackage, L"-e")) {
 781     Status = EditPolicyEntry (DataType, ParamPackage);
 782     if (EFI_ERROR (Status)) {
 783       goto Done;
 784     }
 785   } else if (ShellCommandLineGetFlag (ParamPackage, L"-d")) {
 786     Status = FlushOrDeletePolicyEntry (DataType, ParamPackage);
 787     if (EFI_ERROR (Status)) {
 788       goto Done;
 789     }
 790   } else if (ShellCommandLineGetFlag (ParamPackage, L"-f")) {
 791     Status = FlushOrDeletePolicyEntry (DataType, ParamPackage);
 792     if (EFI_ERROR (Status)) {
 793       goto Done;
 794     }
 795   } else if (ShellCommandLineGetFlag (ParamPackage, L"-l")) {
 796     Status = ListPolicyEntry (DataType, ParamPackage);
 797     if (EFI_ERROR (Status)) {
 798       goto Done;
 799     }
 800   } else {
 801     ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_UNKNOWN_OPERATION), mHiiHandle, mAppName);
 802     goto Done;
 803   }
 804
 805 Done:
 806   ShellCommandLineFreeVarList (ParamPackage);
 807   HiiRemovePackages (mHiiHandle);
 808
 809   return EFI_SUCCESS;
 810 }