ff895bccf010fadbb15057fe8e651b8a81ee58d9
[mirror_edk2.git] / NetworkPkg / Application / IpsecConfig / IpSecConfig.c
1 /** @file
2 The main process for IpSecConfig application.
3
4 Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>
5
6 This program and the accompanying materials
7 are licensed and made available under the terms and conditions of the BSD License
8 which accompanies this distribution. The full text of the license may be found at
9 http://opensource.org/licenses/bsd-license.php.
10
11 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
12 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
13
14 **/
15
16 #include <Library/UefiRuntimeServicesTableLib.h>
17 #include <Library/HiiLib.h>
18
19 #include <Protocol/IpSec.h>
20
21 #include "IpSecConfig.h"
22 #include "Dump.h"
23 #include "Indexer.h"
24 #include "PolicyEntryOperation.h"
25 #include "Delete.h"
26 #include "Helper.h"
27
28 //
29 // Used for ShellCommandLineParseEx only
30 // and to ensure user inputs are in valid format
31 //
32 SHELL_PARAM_ITEM mIpSecConfigParamList[] = {
33 { L"-p", TypeValue },
34 { L"-a", TypeValue },
35 { L"-i", TypeValue },
36 { L"-e", TypeValue },
37 { L"-d", TypeValue },
38 { L"-f", TypeFlag },
39 { L"-l", TypeFlag },
40 { L"-enable", TypeFlag },
41 { L"-disable", TypeFlag },
42 { L"-status", TypeFlag },
43
44 //
45 // SPD Selector
46 //
47 { L"--local", TypeValue },
48 { L"--remote", TypeValue },
49 { L"--proto", TypeValue },
50 { L"--local-port", TypeValue },
51 { L"--remote-port", TypeValue },
52 { L"--icmp-type", TypeValue },
53 { L"--icmp-code", TypeValue },
54
55 //
56 // SPD Data
57 //
58 { L"--name", TypeValue },
59 { L"--packet-flag", TypeValue },
60 { L"--action", TypeValue },
61 { L"--lifebyte", TypeValue },
62 { L"--lifetime-soft", TypeValue },
63 { L"--lifetime", TypeValue },
64 { L"--mode", TypeValue },
65 { L"--tunnel-local", TypeValue },
66 { L"--tunnel-remote", TypeValue },
67 { L"--dont-fragment", TypeValue },
68 { L"--ipsec-proto", TypeValue },
69 { L"--auth-algo", TypeValue },
70 { L"--encrypt-algo", TypeValue },
71
72 { L"--ext-sequence", TypeFlag },
73 { L"--sequence-overflow", TypeFlag },
74 { L"--fragment-check", TypeFlag },
75 { L"--ext-sequence-", TypeFlag },
76 { L"--sequence-overflow-", TypeFlag },
77 { L"--fragment-check-", TypeFlag },
78
79 //
80 // SA ID
81 // --ipsec-proto
82 //
83 { L"--spi", TypeValue },
84 { L"--tunnel-dest", TypeValue },
85 { L"--tunnel-source", TypeValue },
86 { L"--lookup-spi", TypeValue },
87 { L"--lookup-ipsec-proto", TypeValue },
88 { L"--lookup-dest", TypeValue },
89
90 //
91 // SA DATA
92 // --mode
93 // --auth-algo
94 // --encrypt-algo
95 //
96 { L"--sequence-number", TypeValue },
97 { L"--antireplay-window", TypeValue },
98 { L"--auth-key", TypeValue },
99 { L"--encrypt-key", TypeValue },
100 { L"--path-mtu", TypeValue },
101
102 //
103 // PAD ID
104 //
105 { L"--peer-id", TypeValue },
106 { L"--peer-address", TypeValue },
107 { L"--auth-proto", TypeValue },
108 { L"--auth-method", TypeValue },
109 { L"--ike-id", TypeValue },
110 { L"--ike-id-", TypeValue },
111 { L"--auth-data", TypeValue },
112 { L"--revocation-data", TypeValue },
113 { L"--lookup-peer-id", TypeValue },
114 { L"--lookup-peer-address", TypeValue },
115
116 { NULL, TypeMax },
117 };
118
119 //
120 // -P
121 //
122 STR2INT mMapPolicy[] = {
123 { L"SPD", IPsecConfigDataTypeSpd },
124 { L"SAD", IPsecConfigDataTypeSad },
125 { L"PAD", IPsecConfigDataTypePad },
126 { NULL, 0 },
127 };
128
129 //
130 // --proto
131 //
132 STR2INT mMapIpProtocol[] = {
133 { L"TCP", EFI_IP4_PROTO_TCP },
134 { L"UDP", EFI_IP4_PROTO_UDP },
135 { L"ICMP", EFI_IP4_PROTO_ICMP },
136 { NULL, 0 },
137 };
138
139 //
140 // --action
141 //
142 STR2INT mMapIpSecAction[] = {
143 { L"Bypass", EfiIPsecActionBypass },
144 { L"Discard", EfiIPsecActionDiscard },
145 { L"Protect", EfiIPsecActionProtect },
146 { NULL, 0 },
147 };
148
149 //
150 // --mode
151 //
152 STR2INT mMapIpSecMode[] = {
153 { L"Transport", EfiIPsecTransport },
154 { L"Tunnel", EfiIPsecTunnel },
155 { NULL, 0 },
156 };
157
158 //
159 // --dont-fragment
160 //
161 STR2INT mMapDfOption[] = {
162 { L"clear", EfiIPsecTunnelClearDf },
163 { L"set", EfiIPsecTunnelSetDf },
164 { L"copy", EfiIPsecTunnelCopyDf },
165 { NULL, 0 },
166 };
167
168 //
169 // --ipsec-proto
170 //
171 STR2INT mMapIpSecProtocol[] = {
172 { L"AH", EfiIPsecAH },
173 { L"ESP", EfiIPsecESP },
174 { NULL, 0 },
175 };
176
177 //
178 // --auth-algo
179 //
180 STR2INT mMapAuthAlgo[] = {
181 { L"NONE", IPSEC_AALG_NONE },
182 { L"MD5HMAC", IPSEC_AALG_MD5HMAC },
183 { L"SHA1HMAC", IPSEC_AALG_SHA1HMAC },
184 { L"SHA2-256HMAC", IPSEC_AALG_SHA2_256HMAC },
185 { L"SHA2-384HMAC", IPSEC_AALG_SHA2_384HMAC },
186 { L"SHA2-512HMAC", IPSEC_AALG_SHA2_512HMAC },
187 { L"AES-XCBC-MAC", IPSEC_AALG_AES_XCBC_MAC },
188 { L"NULL", IPSEC_AALG_NULL },
189 { NULL, 0 },
190 };
191
192 //
193 // --encrypt-algo
194 //
195 STR2INT mMapEncAlgo[] = {
196 { L"NONE", IPSEC_EALG_NONE },
197 { L"DESCBC", IPSEC_EALG_DESCBC },
198 { L"3DESCBC", IPSEC_EALG_3DESCBC },
199 { L"CASTCBC", IPSEC_EALG_CASTCBC },
200 { L"BLOWFISHCBC", IPSEC_EALG_BLOWFISHCBC },
201 { L"NULL", IPSEC_EALG_NULL },
202 { L"AESCBC", IPSEC_EALG_AESCBC },
203 { L"AESCTR", IPSEC_EALG_AESCTR },
204 { L"AES-CCM-ICV8", IPSEC_EALG_AES_CCM_ICV8 },
205 { L"AES-CCM-ICV12",IPSEC_EALG_AES_CCM_ICV12 },
206 { L"AES-CCM-ICV16",IPSEC_EALG_AES_CCM_ICV16 },
207 { L"AES-GCM-ICV8", IPSEC_EALG_AES_GCM_ICV8 },
208 { L"AES-GCM-ICV12",IPSEC_EALG_AES_GCM_ICV12 },
209 { L"AES-GCM-ICV16",IPSEC_EALG_AES_GCM_ICV16 },
210 { NULL, 0 },
211 };
212
213 //
214 // --auth-proto
215 //
216 STR2INT mMapAuthProto[] = {
217 { L"IKEv1", EfiIPsecAuthProtocolIKEv1 },
218 { L"IKEv2", EfiIPsecAuthProtocolIKEv2 },
219 { NULL, 0 },
220 };
221
222 //
223 // --auth-method
224 //
225 STR2INT mMapAuthMethod[] = {
226 { L"PreSharedSecret", EfiIPsecAuthMethodPreSharedSecret },
227 { L"Certificates", EfiIPsecAuthMethodCertificates },
228 { NULL, 0 },
229 };
230
231 EFI_IPSEC2_PROTOCOL *mIpSec;
232 EFI_IPSEC_CONFIG_PROTOCOL *mIpSecConfig;
233 EFI_HII_HANDLE mHiiHandle;
234 CHAR16 mAppName[] = L"IpSecConfig";
235
236 //
237 // Used for IpSecConfigRetriveCheckListByName only to check the validation of user input
238 //
239 VAR_CHECK_ITEM mIpSecConfigVarCheckList[] = {
240 { L"-enable", BIT(1)|BIT(0), BIT(1), BIT(2)|BIT(1)|BIT(0), 0 },
241 { L"-disable", BIT(1)|BIT(0), BIT(1), BIT(2)|BIT(1)|BIT(0), 0 },
242 { L"-status", BIT(1)|BIT(0), BIT(1), BIT(2)|BIT(1)|BIT(0), 0 },
243 { L"-p", BIT(1), 0, BIT(2)|BIT(1)|BIT(0), 0 },
244
245 { L"-a", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
246 { L"-i", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
247 { L"-d", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
248 { L"-e", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
249 { L"-l", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
250 { L"-f", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
251
252 { L"-?", BIT(0), BIT(0), BIT(2)|BIT(1)|BIT(0), 0 },
253
254 //
255 // SPD Selector
256 //
257 { L"--local", 0, 0, BIT(2)|BIT(1), 0 },
258 { L"--remote", 0, 0, BIT(2)|BIT(1), 0 },
259 { L"--proto", 0, 0, BIT(2)|BIT(1), 0 },
260 { L"--local-port", 0, 0, BIT(2)|BIT(1), BIT(0) },
261 { L"--remote-port", 0, 0, BIT(2)|BIT(1), BIT(0) },
262 { L"--icmp-type", 0, 0, BIT(2)|BIT(1), BIT(1) },
263 { L"--icmp-code", 0, 0, BIT(2)|BIT(1), BIT(1) },
264
265 //
266 // SPD Data
267 //
268 { L"--name", 0, 0, BIT(2), 0 },
269 { L"--packet-flag", 0, 0, BIT(2), 0 },
270 { L"--action", 0, 0, BIT(2)|BIT(1), 0 },
271 { L"--lifebyte", 0, 0, BIT(2)|BIT(1), 0 },
272 { L"--lifetime-soft", 0, 0, BIT(2)|BIT(1), 0 },
273 { L"--lifetime", 0, 0, BIT(2)|BIT(1), 0 },
274 { L"--mode", 0, 0, BIT(2)|BIT(1), 0 },
275 { L"--tunnel-local", 0, 0, BIT(2), 0 },
276 { L"--tunnel-remote", 0, 0, BIT(2), 0 },
277 { L"--dont-fragment", 0, 0, BIT(2), 0 },
278 { L"--ipsec-proto", 0, 0, BIT(2)|BIT(1), 0 },
279 { L"--auth-algo", 0, 0, BIT(2)|BIT(1), 0 },
280 { L"--encrypt-algo", 0, 0, BIT(2)|BIT(1), 0 },
281
282 { L"--ext-sequence", 0, 0, BIT(2), BIT(2) },
283 { L"--sequence-overflow", 0, 0, BIT(2), BIT(2) },
284 { L"--fragment-check", 0, 0, BIT(2), BIT(2) },
285 { L"--ext-sequence-", 0, 0, BIT(2), BIT(3) },
286 { L"--sequence-overflow-", 0, 0, BIT(2), BIT(3) },
287 { L"--fragment-check-", 0, 0, BIT(2), BIT(3) },
288
289 //
290 // SA ID
291 // --ipsec-proto
292 //
293 { L"--spi", 0, 0, BIT(1), 0 },
294 { L"--tunnel-dest", 0, 0, BIT(1), 0 },
295 { L"--tunnel-source", 0, 0, BIT(1), 0 },
296 { L"--lookup-spi", 0, 0, BIT(1), 0 },
297 { L"--lookup-ipsec-proto", 0, 0, BIT(1), 0 },
298 { L"--lookup-dest", 0, 0, BIT(1), 0 },
299
300 //
301 // SA DATA
302 // --mode
303 // --auth-algo
304 // --encrypt-algo
305 //
306 { L"--sequence-number", 0, 0, BIT(1), 0 },
307 { L"--antireplay-window", 0, 0, BIT(1), 0 },
308 { L"--auth-key", 0, 0, BIT(1), 0 },
309 { L"--encrypt-key", 0, 0, BIT(1), 0 },
310 { L"--path-mtu", 0, 0, BIT(1), 0 },
311
312 //
313 // The example to add a PAD:
314 // "-A --peer-id Mike [--peer-address 10.23.2.2] --auth-proto IKE1/IKE2
315 // --auth-method PreSharedSeceret/Certificate --ike-id
316 // --auth-data 343343 --revocation-data 2342432"
317 // The example to delete a PAD:
318 // "-D * --lookup-peer-id Mike [--lookup-peer-address 10.23.2.2]"
319 // "-D 1"
320 // The example to edit a PAD:
321 // "-E * --lookup-peer-id Mike --auth-method Certificate"
322
323 //
324 // PAD ID
325 //
326 { L"--peer-id", 0, 0, BIT(0), BIT(4) },
327 { L"--peer-address", 0, 0, BIT(0), BIT(5) },
328 { L"--auth-proto", 0, 0, BIT(0), 0 },
329 { L"--auth-method", 0, 0, BIT(0), 0 },
330 { L"--IKE-ID", 0, 0, BIT(0), BIT(6) },
331 { L"--IKE-ID-", 0, 0, BIT(0), BIT(7) },
332 { L"--auth-data", 0, 0, BIT(0), 0 },
333 { L"--revocation-data", 0, 0, BIT(0), 0 },
334 { L"--lookup-peer-id", 0, 0, BIT(0), BIT(4) },
335 { L"--lookup-peer-address",0, 0, BIT(0), BIT(5) },
336
337 { NULL, 0, 0, 0, 0 },
338 };
339
340 /**
341 The function to allocate the proper sized buffer for various
342 EFI interfaces.
343
344 @param[in, out] Status Current status.
345 @param[in, out] Buffer Current allocated buffer, or NULL.
346 @param[in] BufferSize Current buffer size needed
347
348 @retval TRUE If the buffer was reallocated and the caller should try the API again.
349 @retval FALSE If the buffer was not reallocated successfully.
350 **/
351 BOOLEAN
352 GrowBuffer (
353 IN OUT EFI_STATUS *Status,
354 IN OUT VOID **Buffer,
355 IN UINTN BufferSize
356 )
357 {
358 BOOLEAN TryAgain;
359
360 ASSERT (Status != NULL);
361 ASSERT (Buffer != NULL);
362
363 //
364 // If this is an initial request, buffer will be null with a new buffer size.
365 //
366 if ((NULL == *Buffer) && (BufferSize != 0)) {
367 *Status = EFI_BUFFER_TOO_SMALL;
368 }
369
370 //
371 // If the status code is "buffer too small", resize the buffer.
372 //
373 TryAgain = FALSE;
374 if (*Status == EFI_BUFFER_TOO_SMALL) {
375
376 if (*Buffer != NULL) {
377 FreePool (*Buffer);
378 }
379
380 *Buffer = AllocateZeroPool (BufferSize);
381
382 if (*Buffer != NULL) {
383 TryAgain = TRUE;
384 } else {
385 *Status = EFI_OUT_OF_RESOURCES;
386 }
387 }
388
389 //
390 // If there's an error, free the buffer.
391 //
392 if (!TryAgain && EFI_ERROR (*Status) && (*Buffer != NULL)) {
393 FreePool (*Buffer);
394 *Buffer = NULL;
395 }
396
397 return TryAgain;
398 }
399
400 /**
401 Function returns an array of handles that support the requested protocol
402 in a buffer allocated from a pool.
403
404 @param[in] SearchType Specifies which handle(s) are to be returned.
405 @param[in] Protocol Provides the protocol to search by.
406 This parameter is only valid for SearchType ByProtocol.
407
408 @param[in] SearchKey Supplies the search key depending on the SearchType.
409 @param[in, out] NoHandles The number of handles returned in Buffer.
410 @param[out] Buffer A pointer to the buffer to return the requested array of
411 handles that support Protocol.
412
413 @retval EFI_SUCCESS The resulting array of handles was returned.
414 @retval Others Other mistake case.
415 **/
416 EFI_STATUS
417 LocateHandle (
418 IN EFI_LOCATE_SEARCH_TYPE SearchType,
419 IN EFI_GUID *Protocol OPTIONAL,
420 IN VOID *SearchKey OPTIONAL,
421 IN OUT UINTN *NoHandles,
422 OUT EFI_HANDLE **Buffer
423 )
424 {
425 EFI_STATUS Status;
426 UINTN BufferSize;
427
428 ASSERT (NoHandles != NULL);
429 ASSERT (Buffer != NULL);
430
431 //
432 // Initialize for GrowBuffer loop.
433 //
434 Status = EFI_SUCCESS;
435 *Buffer = NULL;
436 BufferSize = 50 * sizeof (EFI_HANDLE);
437
438 //
439 // Call the real function.
440 //
441 while (GrowBuffer (&Status, (VOID **) Buffer, BufferSize)) {
442 Status = gBS->LocateHandle (
443 SearchType,
444 Protocol,
445 SearchKey,
446 &BufferSize,
447 *Buffer
448 );
449 }
450
451 *NoHandles = BufferSize / sizeof (EFI_HANDLE);
452 if (EFI_ERROR (Status)) {
453 *NoHandles = 0;
454 }
455
456 return Status;
457 }
458
459 /**
460 Find the first instance of this protocol in the system and return its interface.
461
462 @param[in] ProtocolGuid The guid of the protocol.
463 @param[out] Interface The pointer to the first instance of the protocol.
464
465 @retval EFI_SUCCESS A protocol instance matching ProtocolGuid was found.
466 @retval Others A protocol instance matching ProtocolGuid was not found.
467 **/
468 EFI_STATUS
469 LocateProtocol (
470 IN EFI_GUID *ProtocolGuid,
471 OUT VOID **Interface
472 )
473
474 {
475 EFI_STATUS Status;
476 UINTN NumberHandles;
477 UINTN Index;
478 EFI_HANDLE *Handles;
479
480 *Interface = NULL;
481 Handles = NULL;
482 NumberHandles = 0;
483
484 Status = LocateHandle (ByProtocol, ProtocolGuid, NULL, &NumberHandles, &Handles);
485 if (EFI_ERROR (Status)) {
486 DEBUG ((EFI_D_INFO, "LibLocateProtocol: Handle not found\n"));
487 return Status;
488 }
489
490 for (Index = 0; Index < NumberHandles; Index++) {
491 ASSERT (Handles != NULL);
492 Status = gBS->HandleProtocol (
493 Handles[Index],
494 ProtocolGuid,
495 Interface
496 );
497
498 if (!EFI_ERROR (Status)) {
499 break;
500 }
501 }
502
503 if (Handles != NULL) {
504 FreePool (Handles);
505 }
506
507 return Status;
508 }
509
510 /**
511 Helper function called to check the conflicted flags.
512
513 @param[in] CheckList The pointer to the VAR_CHECK_ITEM table.
514 @param[in] ParamPackage The pointer to the ParamPackage list.
515
516 @retval EFI_SUCCESS No conflicted flags.
517 @retval EFI_INVALID_PARAMETER The input parameter is erroroneous or there are some conflicted flags.
518 **/
519 EFI_STATUS
520 IpSecConfigRetriveCheckListByName (
521 IN VAR_CHECK_ITEM *CheckList,
522 IN LIST_ENTRY *ParamPackage
523 )
524 {
525
526 LIST_ENTRY *Node;
527 VAR_CHECK_ITEM *Item;
528 UINT32 Attribute1;
529 UINT32 Attribute2;
530 UINT32 Attribute3;
531 UINT32 Attribute4;
532 UINT32 Index;
533
534 Attribute1 = 0;
535 Attribute2 = 0;
536 Attribute3 = 0;
537 Attribute4 = 0;
538 Index = 0;
539 Item = mIpSecConfigVarCheckList;
540
541 if ((ParamPackage == NULL) || (CheckList == NULL)) {
542 return EFI_INVALID_PARAMETER;
543 }
544
545 //
546 // Enumerate through the list of parameters that are input by user.
547 //
548 for (Node = GetFirstNode (ParamPackage); !IsNull (ParamPackage, Node); Node = GetNextNode (ParamPackage, Node)) {
549 if (((SHELL_PARAM_PACKAGE *) Node)->Name != NULL) {
550 //
551 // Enumerate the check list that defines the conflicted attributes of each flag.
552 //
553 for (; Item->VarName != NULL; Item++) {
554 if (StrCmp (((SHELL_PARAM_PACKAGE *) Node)->Name, Item->VarName) == 0) {
555 Index++;
556 if (Index == 1) {
557 Attribute1 = Item->Attribute1;
558 Attribute2 = Item->Attribute2;
559 Attribute3 = Item->Attribute3;
560 Attribute4 = Item->Attribute4;
561 } else {
562 Attribute1 &= Item->Attribute1;
563 Attribute2 |= Item->Attribute2;
564 Attribute3 &= Item->Attribute3;
565 Attribute4 |= Item->Attribute4;
566 if (Attribute1 != 0) {
567 return EFI_INVALID_PARAMETER;
568 }
569
570 if (Attribute2 != 0) {
571 if ((Index == 2) && (StrCmp (Item->VarName, L"-p") == 0)) {
572 continue;
573 }
574
575 return EFI_INVALID_PARAMETER;
576 }
577
578 if (Attribute3 == 0) {
579 return EFI_INVALID_PARAMETER;
580 }
581 if (((Attribute4 & 0xFF) == 0x03) || ((Attribute4 & 0xFF) == 0x0C) ||
582 ((Attribute4 & 0xFF) == 0x30) || ((Attribute4 & 0xFF) == 0xC0)) {
583 return EFI_INVALID_PARAMETER;
584 }
585 }
586 break;
587 }
588 }
589
590 Item = mIpSecConfigVarCheckList;
591 }
592 }
593
594 return EFI_SUCCESS;
595 }
596
597 /**
598 This is the declaration of an EFI image entry point. This entry point is
599 the same for UEFI Applications, UEFI OS Loaders, and UEFI Drivers, including
600 both device drivers and bus drivers.
601
602 The entry point for IpSecConfig application that parse the command line input and call an IpSecConfig process.
603
604 @param[in] ImageHandle The image handle of this application.
605 @param[in] SystemTable The pointer to the EFI System Table.
606
607 @retval EFI_SUCCESS The operation completed successfully.
608
609 **/
610 EFI_STATUS
611 EFIAPI
612 InitializeIpSecConfig (
613 IN EFI_HANDLE ImageHandle,
614 IN EFI_SYSTEM_TABLE *SystemTable
615 )
616 {
617 EFI_STATUS Status;
618 EFI_IPSEC_CONFIG_DATA_TYPE DataType;
619 UINT8 Value;
620 LIST_ENTRY *ParamPackage;
621 CONST CHAR16 *ValueStr;
622 CHAR16 *ProblemParam;
623 UINTN NonOptionCount;
624 EFI_HII_PACKAGE_LIST_HEADER *PackageList;
625
626 //
627 // Retrieve HII package list from ImageHandle
628 //
629 Status = gBS->OpenProtocol (
630 ImageHandle,
631 &gEfiHiiPackageListProtocolGuid,
632 (VOID **) &PackageList,
633 ImageHandle,
634 NULL,
635 EFI_OPEN_PROTOCOL_GET_PROTOCOL
636 );
637 if (EFI_ERROR (Status)) {
638 return Status;
639 }
640
641 //
642 // Publish HII package list to HII Database.
643 //
644 Status = gHiiDatabase->NewPackageList (
645 gHiiDatabase,
646 PackageList,
647 NULL,
648 &mHiiHandle
649 );
650 if (EFI_ERROR (Status)) {
651 return Status;
652 }
653
654 ASSERT (mHiiHandle != NULL);
655
656 Status = ShellCommandLineParseEx (mIpSecConfigParamList, &ParamPackage, &ProblemParam, TRUE, FALSE);
657 if (EFI_ERROR (Status)) {
658 ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_UNKNOWN_OPERATION), mHiiHandle, ProblemParam);
659 goto Done;
660 }
661
662 Status = IpSecConfigRetriveCheckListByName (mIpSecConfigVarCheckList, ParamPackage);
663 if (EFI_ERROR (Status)) {
664 ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_MISTAKEN_OPTIONS), mHiiHandle);
665 goto Done;
666 }
667
668 Status = LocateProtocol (&gEfiIpSecConfigProtocolGuid, (VOID **) &mIpSecConfig);
669 if (EFI_ERROR (Status) || mIpSecConfig == NULL) {
670 ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_PROTOCOL_INEXISTENT), mHiiHandle, mAppName);
671 goto Done;
672 }
673
674 Status = LocateProtocol (&gEfiIpSec2ProtocolGuid, (VOID **) &mIpSec);
675 if (EFI_ERROR (Status) || mIpSec == NULL) {
676 ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_PROTOCOL_INEXISTENT), mHiiHandle, mAppName);
677 goto Done;
678 }
679
680 //
681 // Enable IPsec.
682 //
683 if (ShellCommandLineGetFlag (ParamPackage, L"-enable")) {
684 if (!(mIpSec->DisabledFlag)) {
685 ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_ALREADY_ENABLE), mHiiHandle, mAppName);
686 } else {
687 //
688 // Set enable flag.
689 //
690 Value = IPSEC_STATUS_ENABLED;
691 Status = gRT->SetVariable (
692 IPSECCONFIG_STATUS_NAME,
693 &gEfiIpSecConfigProtocolGuid,
694 EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_NON_VOLATILE,
695 sizeof (Value),
696 &Value
697 );
698 if (!EFI_ERROR (Status)) {
699 mIpSec->DisabledFlag = FALSE;
700 ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_ENABLE_SUCCESS), mHiiHandle, mAppName);
701 } else {
702 ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_ENABLE_FAILED), mHiiHandle, mAppName);
703 }
704 }
705
706 goto Done;
707 }
708
709 //
710 // Disable IPsec.
711 //
712 if (ShellCommandLineGetFlag (ParamPackage, L"-disable")) {
713 if (mIpSec->DisabledFlag) {
714 ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_ALREADY_DISABLE), mHiiHandle, mAppName);
715 } else {
716 //
717 // Set disable flag; however, leave it to be disabled in the callback function of DisabledEvent.
718 //
719 gBS->SignalEvent (mIpSec->DisabledEvent);
720 if (mIpSec->DisabledFlag) {
721 ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_DISABLE_SUCCESS), mHiiHandle, mAppName);
722 } else {
723 ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_DISABLE_FAILED), mHiiHandle, mAppName);
724 }
725 }
726
727 goto Done;
728 }
729
730 //
731 //IPsec Status.
732 //
733 if (ShellCommandLineGetFlag (ParamPackage, L"-status")) {
734 if (mIpSec->DisabledFlag) {
735 ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_STATUS_DISABLE), mHiiHandle, mAppName);
736 } else {
737 ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_STATUS_ENABLE), mHiiHandle, mAppName);
738 }
739 goto Done;
740 }
741
742 //
743 // Try to get policy database type.
744 //
745 DataType = (EFI_IPSEC_CONFIG_DATA_TYPE) - 1;
746 ValueStr = ShellCommandLineGetValue (ParamPackage, L"-p");
747 if (ValueStr != NULL) {
748 DataType = (EFI_IPSEC_CONFIG_DATA_TYPE) MapStringToInteger (ValueStr, mMapPolicy);
749 if (DataType == -1) {
750 ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_INCORRECT_DB), mHiiHandle, mAppName, ValueStr);
751 goto Done;
752 }
753 }
754
755 NonOptionCount = ShellCommandLineGetCount (ParamPackage);
756 if ((NonOptionCount - 1) > 0) {
757 ValueStr = ShellCommandLineGetRawValue (ParamPackage, (UINT32) (NonOptionCount - 1));
758 ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_REDUNDANCY_MANY), mHiiHandle, mAppName, ValueStr);
759 goto Done;
760 }
761
762 if (DataType == -1) {
763 ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_DB), mHiiHandle, mAppName);
764 goto Done;
765 }
766
767 if (ShellCommandLineGetFlag (ParamPackage, L"-a")) {
768 Status = AddOrInsertPolicyEntry (DataType, ParamPackage);
769 if (EFI_ERROR (Status)) {
770 goto Done;
771 }
772 } else if (ShellCommandLineGetFlag (ParamPackage, L"-i")) {
773 Status = AddOrInsertPolicyEntry (DataType, ParamPackage);
774 if (EFI_ERROR (Status)) {
775 goto Done;
776 }
777 } else if (ShellCommandLineGetFlag (ParamPackage, L"-e")) {
778 Status = EditPolicyEntry (DataType, ParamPackage);
779 if (EFI_ERROR (Status)) {
780 goto Done;
781 }
782 } else if (ShellCommandLineGetFlag (ParamPackage, L"-d")) {
783 Status = FlushOrDeletePolicyEntry (DataType, ParamPackage);
784 if (EFI_ERROR (Status)) {
785 goto Done;
786 }
787 } else if (ShellCommandLineGetFlag (ParamPackage, L"-f")) {
788 Status = FlushOrDeletePolicyEntry (DataType, ParamPackage);
789 if (EFI_ERROR (Status)) {
790 goto Done;
791 }
792 } else if (ShellCommandLineGetFlag (ParamPackage, L"-l")) {
793 Status = ListPolicyEntry (DataType, ParamPackage);
794 if (EFI_ERROR (Status)) {
795 goto Done;
796 }
797 } else {
798 ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_UNKNOWN_OPERATION), mHiiHandle, mAppName);
799 goto Done;
800 }
801
802 Done:
803 ShellCommandLineFreeVarList (ParamPackage);
804 HiiRemovePackages (mHiiHandle);
805
806 return EFI_SUCCESS;
807 }