NetworkPkg/IpSecDxe/IkeCommon.c

   1 /** @file
   2   Common operation of the IKE
   3
   4   Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR>
   5
   6   This program and the accompanying materials
   7   are licensed and made available under the terms and conditions of the BSD License
   8   which accompanies this distribution.  The full text of the license may be found at
   9   http://opensource.org/licenses/bsd-license.php.
  10
  11   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  12   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  13
  14 **/
  15
  16 #include "Ike.h"
  17 #include "IkeCommon.h"
  18 #include "IpSecConfigImpl.h"
  19 #include "IpSecDebug.h"
  20
  21 /**
  22   Check whether the new generated Spi has existed.
  23
  24   @param[in]   IkeSaSession   Pointer to the Child SA Session.
  25   @param[in]   SpiValue       SPI Value.
  26
  27   @retval  TRUE    This SpiValue has existed in the Child SA Session
  28   @retval  FALSE   This SpiValue doesn't exist in the Child SA Session.
  29
  30 **/
  31 BOOLEAN
  32 IkeSpiValueExisted (
  33   IN IKEV2_SA_SESSION      *IkeSaSession,
  34   IN UINT32                SpiValue
  35   )
  36 {
  37   LIST_ENTRY              *Entry;
  38   LIST_ENTRY              *Next;
  39   IKEV2_CHILD_SA_SESSION  *SaSession;
  40
  41   Entry     = NULL;
  42   Next      = NULL;
  43   SaSession = NULL;
  44
  45   //
  46   // Check whether the SPI value has existed in ChildSaEstablishSessionList.
  47   //
  48   NET_LIST_FOR_EACH_SAFE (Entry, Next, &IkeSaSession->ChildSaEstablishSessionList) {
  49     SaSession= IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);
  50     if (SaSession->LocalPeerSpi == SpiValue) {
  51       return TRUE;
  52     }
  53   }
  54
  55   //
  56   // Check whether the SPI value has existed in ChildSaSessionList.
  57   //
  58   NET_LIST_FOR_EACH_SAFE (Entry, Next, &IkeSaSession->ChildSaSessionList) {
  59     SaSession= IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);
  60     if (SaSession->LocalPeerSpi == SpiValue) {
  61       return TRUE;
  62     }
  63   }
  64
  65   return FALSE;
  66 }
  67
  68 /**
  69   Call Crypto Lib to generate a random value with eight-octet length.
  70
  71   @return the 64 byte vaule.
  72
  73 **/
  74 UINT64
  75 IkeGenerateCookie (
  76   VOID
  77   )
  78 {
  79   UINT64     Cookie;
  80   EFI_STATUS Status;
  81
  82   Status = IpSecCryptoIoGenerateRandomBytes ((UINT8 *)&Cookie, sizeof (UINT64));
  83   if (EFI_ERROR (Status)) {
  84     return 0;
  85   } else {
  86     return Cookie;
  87   }
  88 }
  89
  90 /**
  91   Generate the random data for Nonce payload.
  92
  93   @param[in]  NonceSize      Size of the data in bytes.
  94
  95   @return Buffer which contains the random data of the spcified size.
  96
  97 **/
  98 UINT8 *
  99 IkeGenerateNonce (
 100   IN UINTN              NonceSize
 101   )
 102 {
 103   UINT8                  *Nonce;
 104   EFI_STATUS             Status;
 105
 106   Nonce = AllocateZeroPool (NonceSize);
 107   if (Nonce == NULL) {
 108     return NULL;
 109   }
 110
 111   Status = IpSecCryptoIoGenerateRandomBytes (Nonce, NonceSize);
 112   if (EFI_ERROR (Status)) {
 113     FreePool (Nonce);
 114     return NULL;
 115   } else {
 116     return Nonce;
 117   }
 118 }
 119
 120 /**
 121   Convert the IKE Header from Network order to Host order.
 122
 123   @param[in, out]  Header    The pointer of the IKE_HEADER.
 124
 125 **/
 126 VOID
 127 IkeHdrNetToHost (
 128   IN OUT IKE_HEADER *Header
 129   )
 130 {
 131   Header->InitiatorCookie = NTOHLL (Header->InitiatorCookie);
 132   Header->ResponderCookie = NTOHLL (Header->ResponderCookie);
 133   Header->MessageId       = NTOHL (Header->MessageId);
 134   Header->Length          = NTOHL (Header->Length);
 135 }
 136
 137 /**
 138   Convert the IKE Header from Host order to Network order.
 139
 140   @param[in, out] Header     The pointer of the IKE_HEADER.
 141
 142 **/
 143 VOID
 144 IkeHdrHostToNet (
 145   IN OUT IKE_HEADER *Header
 146   )
 147 {
 148   Header->InitiatorCookie = HTONLL (Header->InitiatorCookie);
 149   Header->ResponderCookie = HTONLL (Header->ResponderCookie);
 150   Header->MessageId       = HTONL (Header->MessageId);
 151   Header->Length          = HTONL (Header->Length);
 152 }
 153
 154 /**
 155   Allocate a buffer of IKE_PAYLOAD and set its Signature.
 156
 157   @return A buffer of IKE_PAYLOAD.
 158
 159 **/
 160 IKE_PAYLOAD *
 161 IkePayloadAlloc (
 162   VOID
 163   )
 164 {
 165   IKE_PAYLOAD *IkePayload;
 166
 167   IkePayload            = (IKE_PAYLOAD *) AllocateZeroPool (sizeof (IKE_PAYLOAD));
 168   if (IkePayload == NULL) {
 169     return NULL;
 170   }
 171
 172   IkePayload->Signature = IKE_PAYLOAD_SIGNATURE;
 173
 174   return IkePayload;
 175 }
 176
 177 /**
 178   Free a specified IKE_PAYLOAD buffer.
 179
 180   @param[in]  IkePayload   Pointer of IKE_PAYLOAD to be freed.
 181
 182 **/
 183 VOID
 184 IkePayloadFree (
 185   IN IKE_PAYLOAD *IkePayload
 186   )
 187 {
 188   if (IkePayload == NULL) {
 189     return;
 190   }
 191   //
 192   // If this IkePayload is not referred by others, free it.
 193   //
 194   if (!IkePayload->IsPayloadBufExt && (IkePayload->PayloadBuf != NULL)) {
 195     FreePool (IkePayload->PayloadBuf);
 196   }
 197
 198   FreePool (IkePayload);
 199 }
 200
 201 /**
 202   Generate an new SPI.
 203
 204   @param[in]       IkeSaSession   Pointer to IKEV2_SA_SESSION related to this Child SA
 205                                   Session.
 206   @param[in, out]  SpiValue       Pointer to the new generated SPI value.
 207
 208   @retval EFI_SUCCESS         The operation performs successfully.
 209   @retval Otherwise           The operation is failed.
 210
 211 **/
 212 EFI_STATUS
 213 IkeGenerateSpi (
 214   IN     IKEV2_SA_SESSION         *IkeSaSession,
 215   IN OUT UINT32                   *SpiValue
 216   )
 217 {
 218   EFI_STATUS   Status;
 219
 220   Status = EFI_SUCCESS;
 221
 222   while (TRUE) {
 223     //
 224     // Generate SPI randomly
 225     //
 226     Status = IpSecCryptoIoGenerateRandomBytes ((UINT8 *)SpiValue, sizeof (UINT32));
 227     if (EFI_ERROR (Status)) {
 228       break;
 229     }
 230
 231     //
 232     // The set of SPI values in the range 1 through 255 are reserved by the
 233     // Internet Assigned Numbers Authority (IANA) for future use; a reserved
 234     // SPI value will not normally be assigned by IANA unless the use of the
 235     // assigned SPI value is specified in an RFC.
 236     //
 237     if (*SpiValue < IKE_SPI_BASE) {
 238       *SpiValue += IKE_SPI_BASE;
 239     }
 240
 241     //
 242     // Check whether the new generated SPI has existed.
 243     //
 244     if (!IkeSpiValueExisted (IkeSaSession, *SpiValue)) {
 245       break;
 246     }
 247   }
 248
 249   return Status;
 250 }
 251
 252 /**
 253   Generate a random data for IV
 254
 255   @param[in]  IvBuffer  The pointer of the IV buffer.
 256   @param[in]  IvSize    The IV size.
 257
 258   @retval     EFI_SUCCESS  Create a random data for IV.
 259   @retval     otherwise    Failed.
 260
 261 **/
 262 EFI_STATUS
 263 IkeGenerateIv (
 264   IN UINT8                           *IvBuffer,
 265   IN UINTN                           IvSize
 266   )
 267 {
 268   return IpSecCryptoIoGenerateRandomBytes (IvBuffer, IvSize);
 269 }
 270
 271
 272 /**
 273   Find SPD entry by a specified SPD selector.
 274
 275   @param[in] SpdSel       Point to SPD Selector to be searched for.
 276
 277   @retval Point to SPD Entry if the SPD entry found.
 278   @retval NULL if not found.
 279
 280 **/
 281 IPSEC_SPD_ENTRY *
 282 IkeSearchSpdEntry (
 283   IN EFI_IPSEC_SPD_SELECTOR             *SpdSel
 284   )
 285 {
 286   IPSEC_SPD_ENTRY *SpdEntry;
 287   LIST_ENTRY      *SpdList;
 288   LIST_ENTRY      *Entry;
 289
 290   SpdList = &mConfigData[IPsecConfigDataTypeSpd];
 291
 292   NET_LIST_FOR_EACH (Entry, SpdList) {
 293     SpdEntry = IPSEC_SPD_ENTRY_FROM_LIST (Entry);
 294
 295     //
 296     // Find the required SPD entry
 297     //
 298     if (CompareSpdSelector (
 299           (EFI_IPSEC_CONFIG_SELECTOR *) SpdSel,
 300           (EFI_IPSEC_CONFIG_SELECTOR *) SpdEntry->Selector
 301           )) {
 302       return SpdEntry;
 303     }
 304
 305   }
 306
 307   return NULL;
 308 }
 309
 310 /**
 311   Get the IKE Version from the IKE_SA_SESSION.
 312
 313   @param[in]  Session  Pointer of the IKE_SA_SESSION.
 314
 315 **/
 316 UINT8
 317 IkeGetVersionFromSession (
 318   IN UINT8    *Session
 319   )
 320 {
 321   if (*(UINT32 *) Session == IKEV2_SA_SESSION_SIGNATURE) {
 322     return ((IKEV2_SA_SESSION *) Session)->SessionCommon.IkeVer;
 323   } else {
 324     //
 325     // Add IKEv1 support here.
 326     //
 327     return 0;
 328   }
 329 }
 330