NetworkPkg: Remove IpSecDxe and Ip4Config Protocol dependency.
[mirror_edk2.git] / NetworkPkg / IpSecDxe / IkeService.c
1 /** @file
2 Provide IPsec Key Exchange (IKE) service general interfaces.
3
4 Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>
5
6 This program and the accompanying materials
7 are licensed and made available under the terms and conditions of the BSD License
8 which accompanies this distribution. The full text of the license may be found at
9 http://opensource.org/licenses/bsd-license.php.
10
11 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
12 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
13
14 **/
15
16 #include "IkeService.h"
17 #include "IpSecConfigImpl.h"
18 #include "Ikev2/Utility.h"
19
20 IKE_EXCHANGE_INTERFACE *mIkeExchange[] = {
21 &mIkev1Exchange,
22 &mIkev2Exchange
23 };
24
25 EFI_UDP4_CONFIG_DATA mUdp4Conf = {
26 FALSE,
27 FALSE,
28 FALSE,
29 TRUE,
30 //
31 // IO parameters
32 //
33 0,
34 64,
35 FALSE,
36 0,
37 1000000,
38 FALSE,
39 {{0,0,0,0}},
40 {{0,0,0,0}},
41 IKE_DEFAULT_PORT,
42 {{0,0,0,0}},
43 0
44 };
45
46 EFI_UDP6_CONFIG_DATA mUdp6Conf = {
47 FALSE,
48 FALSE,
49 TRUE,
50 //
51 // IO parameters
52 //
53 0,
54 128,
55 0,
56 1000000,
57 //Access Point
58 {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}},
59 IKE_DEFAULT_PORT,
60 {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}},
61 0
62 };
63
64 /**
65 Check if the NIC handle is binded to a Udp service.
66
67 @param[in] Private Pointer of IPSEC_PRIVATE_DATA.
68 @param[in] Handle The Handle of the NIC card.
69 @param[in] IpVersion The version of the IP stack.
70
71 @return a pointer of IKE_UDP_SERVICE.
72
73 **/
74 IKE_UDP_SERVICE *
75 IkeLookupUdp (
76 IN IPSEC_PRIVATE_DATA *Private,
77 IN EFI_HANDLE Handle,
78 IN UINT8 IpVersion
79 )
80 {
81 LIST_ENTRY *Head;
82 LIST_ENTRY *Entry;
83 LIST_ENTRY *Next;
84 IKE_UDP_SERVICE *Udp;
85
86 Udp = NULL;
87 Head = (IpVersion == IP_VERSION_4) ? &Private->Udp4List : &Private->Udp6List;
88
89 NET_LIST_FOR_EACH_SAFE (Entry, Next, Head) {
90
91 Udp = IPSEC_UDP_SERVICE_FROM_LIST (Entry);
92 //
93 // Find the right udp service which installed on the appointed NIC handle.
94 //
95 if (Handle == Udp->NicHandle) {
96 break;
97 } else {
98 Udp = NULL;
99 }
100 }
101
102 return Udp;
103 }
104
105 /**
106 Configure a UDPIO's UDP4 instance.
107
108 This fuction is called by the UdpIoCreateIo() to configures a
109 UDP4 instance.
110
111 @param[in] UdpIo The UDP_IO to be configured.
112 @param[in] Context User-defined data when calling UdpIoCreateIo().
113
114 @retval EFI_SUCCESS The configuration succeeded.
115 @retval Others The UDP4 instance fails to configure.
116
117 **/
118 EFI_STATUS
119 EFIAPI
120 IkeConfigUdp4 (
121 IN UDP_IO *UdpIo,
122 IN VOID *Context
123 )
124 {
125 EFI_UDP4_CONFIG_DATA Udp4Cfg;
126 EFI_UDP4_PROTOCOL *Udp4;
127
128 ZeroMem (&Udp4Cfg, sizeof (EFI_UDP4_CONFIG_DATA));
129
130 Udp4 = UdpIo->Protocol.Udp4;
131 CopyMem (
132 &Udp4Cfg,
133 &mUdp4Conf,
134 sizeof (EFI_UDP4_CONFIG_DATA)
135 );
136
137 if (Context != NULL) {
138 //
139 // Configure udp4 io with local default address.
140 //
141 Udp4Cfg.UseDefaultAddress = TRUE;
142 }
143
144 return Udp4->Configure (Udp4, &Udp4Cfg);
145 }
146
147 /**
148 Configure a UDPIO's UDP6 instance.
149
150 This fuction is called by the UdpIoCreateIo()to configure a
151 UDP6 instance.
152
153 @param[in] UdpIo The UDP_IO to be configured.
154 @param[in] Context User-defined data when calling UdpIoCreateIo().
155
156 @retval EFI_SUCCESS The configuration succeeded.
157 @retval Others The configuration fails.
158
159 **/
160 EFI_STATUS
161 EFIAPI
162 IkeConfigUdp6 (
163 IN UDP_IO *UdpIo,
164 IN VOID *Context
165 )
166 {
167 EFI_UDP6_PROTOCOL *Udp6;
168 EFI_UDP6_CONFIG_DATA Udp6Cfg;
169
170 ZeroMem (&Udp6Cfg, sizeof (EFI_UDP6_CONFIG_DATA));
171
172 Udp6 = UdpIo->Protocol.Udp6;
173 CopyMem (
174 &Udp6Cfg,
175 &mUdp6Conf,
176 sizeof (EFI_UDP6_CONFIG_DATA)
177 );
178
179 if (Context != NULL) {
180 //
181 // Configure instance with a destination address to start source address
182 // selection, and then get the configure data from the mode data to store
183 // the source address.
184 //
185 CopyMem (
186 &Udp6Cfg.RemoteAddress,
187 Context,
188 sizeof (EFI_IPv6_ADDRESS)
189 );
190 }
191
192 return Udp6->Configure (Udp6, &Udp6Cfg);
193 }
194
195 /**
196 Open and configure the related output UDPIO for IKE packet sending.
197
198 If the UdpService is not configured, this fuction calls UdpIoCreatIo() to
199 create UDPIO to bind this UdpService for IKE packet sending. If the UdpService
200 has already been configured, then return.
201
202 @param[in] UdpService The UDP_IO to be configured.
203 @param[in] RemoteIp User-defined data when calling UdpIoCreateIo().
204
205 @retval EFI_SUCCESS The configuration is successful.
206 @retval Others The configuration fails.
207
208 **/
209 EFI_STATUS
210 IkeOpenOutputUdp (
211 IN IKE_UDP_SERVICE *UdpService,
212 IN EFI_IP_ADDRESS *RemoteIp
213 )
214 {
215 EFI_STATUS Status;
216 EFI_IP4_CONFIG2_PROTOCOL *Ip4Cfg2;
217 EFI_IP4_CONFIG2_INTERFACE_INFO *IfInfo;
218 UINTN BufSize;
219 EFI_IP6_MODE_DATA Ip6ModeData;
220 EFI_UDP6_PROTOCOL *Udp6;
221
222 Status = EFI_SUCCESS;
223 IfInfo = NULL;
224 BufSize = 0;
225
226 //
227 // Check whether the input and output udp io are both configured.
228 //
229 if (UdpService->IsConfigured) {
230 goto ON_EXIT;
231 }
232
233 if (UdpService->IpVersion == UDP_IO_UDP4_VERSION) {
234 //
235 // Handle ip4config protocol to get local default address.
236 //
237 Status = gBS->HandleProtocol (
238 UdpService->NicHandle,
239 &gEfiIp4Config2ProtocolGuid,
240 (VOID **) &Ip4Cfg2
241 );
242
243 if (EFI_ERROR (Status)) {
244 goto ON_EXIT;
245 }
246
247 //
248 // Get the interface information size.
249 //
250 Status = Ip4Cfg2->GetData (
251 Ip4Cfg2,
252 Ip4Config2DataTypeInterfaceInfo,
253 &BufSize,
254 NULL
255 );
256
257 if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {
258 goto ON_EXIT;
259 }
260
261 IfInfo = AllocateZeroPool (BufSize);
262
263 if (IfInfo == NULL) {
264 Status = EFI_OUT_OF_RESOURCES;
265 goto ON_EXIT;
266 }
267
268 //
269 // Get the interface info.
270 //
271 Status = Ip4Cfg2->GetData (
272 Ip4Cfg2,
273 Ip4Config2DataTypeInterfaceInfo,
274 &BufSize,
275 IfInfo
276 );
277
278 if (EFI_ERROR (Status)) {
279 goto ON_EXIT;
280 }
281
282 CopyMem (
283 &UdpService->DefaultAddress.v4,
284 &IfInfo->StationAddress,
285 sizeof (EFI_IPv4_ADDRESS)
286 );
287
288 //
289 // Create udp4 io for output with local default address.
290 //
291 UdpService->Output = UdpIoCreateIo (
292 UdpService->NicHandle,
293 UdpService->ImageHandle,
294 IkeConfigUdp4,
295 UDP_IO_UDP4_VERSION,
296 &UdpService->DefaultAddress
297 );
298
299 if (UdpService->Output == NULL) {
300 Status = EFI_OUT_OF_RESOURCES;
301 goto ON_EXIT;
302 }
303
304 } else {
305 //
306 // Create udp6 io for output with remote address.
307 //
308 UdpService->Output = UdpIoCreateIo (
309 UdpService->NicHandle,
310 UdpService->ImageHandle,
311 IkeConfigUdp6,
312 UDP_IO_UDP6_VERSION,
313 RemoteIp
314 );
315
316 if (UdpService->Output == NULL) {
317 Status = EFI_OUT_OF_RESOURCES;
318 goto ON_EXIT;
319 }
320 //
321 // Get ip6 mode data to get the result of source address selection.
322 //
323 ZeroMem (&Ip6ModeData, sizeof (EFI_IP6_MODE_DATA));
324
325 Udp6 = UdpService->Output->Protocol.Udp6;
326 Status = Udp6->GetModeData (Udp6, NULL, &Ip6ModeData, NULL, NULL);
327
328 if (EFI_ERROR (Status)) {
329 UdpIoFreeIo (UdpService->Output);
330 goto ON_EXIT;
331 }
332 //
333 // Reconfigure udp6 io without remote address.
334 //
335 Udp6->Configure (Udp6, NULL);
336 Status = IkeConfigUdp6 (UdpService->Output, NULL);
337
338 //
339 // Record the selected source address for ipsec process later.
340 //
341 CopyMem (
342 &UdpService->DefaultAddress.v6,
343 &Ip6ModeData.ConfigData.StationAddress,
344 sizeof (EFI_IPv6_ADDRESS)
345 );
346 }
347
348 UdpService->IsConfigured = TRUE;
349
350 ON_EXIT:
351 if (IfInfo != NULL) {
352 FreePool (IfInfo);
353 }
354
355 return Status;
356 }
357
358 /**
359 Open and configure a UDPIO of Udp4 for IKE packet receiving.
360
361 This function is called at the IPsecDriverBinding start. IPsec create a UDP4 and
362 UDP4 IO for each NIC handle.
363
364 @param[in] Private Point to IPSEC_PRIVATE_DATA
365 @param[in] Controller Handler for NIC card.
366 @param[in] ImageHandle The handle that contains the EFI_DRIVER_BINDING_PROTOCOL instance.
367
368 @retval EFI_SUCCESS The Operation is successful.
369 @retval EFI_OUT_OF_RESOURCE The required system resource can't be allocated.
370
371 **/
372 EFI_STATUS
373 IkeOpenInputUdp4 (
374 IN IPSEC_PRIVATE_DATA *Private,
375 IN EFI_HANDLE Controller,
376 IN EFI_HANDLE ImageHandle
377 )
378 {
379 IKE_UDP_SERVICE *Udp4Srv;
380
381 //
382 // Check whether udp4 io of the controller has already been opened.
383 //
384 Udp4Srv = IkeLookupUdp (Private, Controller, IP_VERSION_4);
385
386 if (Udp4Srv != NULL) {
387 return EFI_ALREADY_STARTED;
388 }
389
390 Udp4Srv = AllocateZeroPool (sizeof (IKE_UDP_SERVICE));
391
392 if (Udp4Srv == NULL) {
393 return EFI_OUT_OF_RESOURCES;
394 }
395 //
396 // Create udp4 io for iutput.
397 //
398 Udp4Srv->Input = UdpIoCreateIo (
399 Controller,
400 ImageHandle,
401 IkeConfigUdp4,
402 UDP_IO_UDP4_VERSION,
403 NULL
404 );
405
406 if (Udp4Srv->Input == NULL) {
407 FreePool (Udp4Srv);
408 return EFI_OUT_OF_RESOURCES;
409 }
410
411 Udp4Srv->NicHandle = Controller;
412 Udp4Srv->ImageHandle = ImageHandle;
413 Udp4Srv->ListHead = &(Private->Udp4List);
414 Udp4Srv->IpVersion = UDP_IO_UDP4_VERSION;
415 Udp4Srv->IsConfigured = FALSE;
416
417 ZeroMem (&Udp4Srv->DefaultAddress, sizeof (EFI_IP_ADDRESS));
418
419 //
420 // Insert the udp4 io into the list and increase the count.
421 //
422 InsertTailList (&Private->Udp4List, &Udp4Srv->List);
423
424 Private->Udp4Num++;
425
426 UdpIoRecvDatagram (Udp4Srv->Input, IkeDispatch, Udp4Srv, 0);
427
428 return EFI_SUCCESS;
429 }
430
431 /**
432 Open and configure a UDPIO of Udp6 for IKE packet receiving.
433
434 This function is called at the IPsecDriverBinding start. IPsec create a UDP6 and UDP6
435 IO for each NIC handle.
436
437 @param[in] Private Point to IPSEC_PRIVATE_DATA
438 @param[in] Controller Handler for NIC card.
439 @param[in] ImageHandle The handle that contains the EFI_DRIVER_BINDING_PROTOCOL instance.
440
441 @retval EFI_SUCCESS The Operation is successful.
442 @retval EFI_OUT_OF_RESOURCE The required system resource can't be allocated.
443
444 **/
445 EFI_STATUS
446 IkeOpenInputUdp6 (
447 IN IPSEC_PRIVATE_DATA *Private,
448 IN EFI_HANDLE Controller,
449 IN EFI_HANDLE ImageHandle
450 )
451 {
452 IKE_UDP_SERVICE *Udp6Srv;
453
454 Udp6Srv = IkeLookupUdp (Private, Controller, IP_VERSION_6);
455
456 if (Udp6Srv != NULL) {
457 return EFI_ALREADY_STARTED;
458 }
459
460 Udp6Srv = AllocateZeroPool (sizeof (IKE_UDP_SERVICE));
461
462 if (Udp6Srv == NULL) {
463 return EFI_OUT_OF_RESOURCES;
464 }
465 //
466 // Create udp6 io for input.
467 //
468 Udp6Srv->Input = UdpIoCreateIo (
469 Controller,
470 ImageHandle,
471 IkeConfigUdp6,
472 UDP_IO_UDP6_VERSION,
473 NULL
474 );
475
476 if (Udp6Srv->Input == NULL) {
477 FreePool (Udp6Srv);
478 return EFI_OUT_OF_RESOURCES;
479 }
480
481 Udp6Srv->NicHandle = Controller;
482 Udp6Srv->ImageHandle = ImageHandle;
483 Udp6Srv->ListHead = &(Private->Udp6List);
484 Udp6Srv->IpVersion = UDP_IO_UDP6_VERSION;
485 Udp6Srv->IsConfigured = FALSE;
486
487 ZeroMem (&Udp6Srv->DefaultAddress, sizeof (EFI_IP_ADDRESS));
488
489 //
490 // Insert the udp6 io into the list and increase the count.
491 //
492 InsertTailList (&Private->Udp6List, &Udp6Srv->List);
493
494 Private->Udp6Num++;
495
496 UdpIoRecvDatagram (Udp6Srv->Input, IkeDispatch, Udp6Srv, 0);
497
498 return EFI_SUCCESS;
499 }
500
501 /**
502 The general interface of starting IPsec Key Exchange.
503
504 This function is called when a IKE negotiation to start getting a Key.
505
506 @param[in] UdpService Point to IKE_UDP_SERVICE which will be used for
507 IKE packet sending.
508 @param[in] SpdEntry Point to the SPD entry related to the IKE negotiation.
509 @param[in] RemoteIp Point to EFI_IP_ADDRESS related to the IKE negotiation.
510
511 @retval EFI_SUCCESS The Operation is successful.
512 @retval EFI_ACCESS_DENIED No related PAD entry was found.
513 @retval EFI_INVALID_PARAMETER The IKE version is not supported.
514
515 **/
516 EFI_STATUS
517 IkeNegotiate (
518 IN IKE_UDP_SERVICE *UdpService,
519 IN IPSEC_SPD_ENTRY *SpdEntry,
520 IN EFI_IP_ADDRESS *RemoteIp
521 )
522 {
523 EFI_STATUS Status;
524 UINT8 *IkeSaSession;
525 IKE_EXCHANGE_INTERFACE *Exchange;
526 IPSEC_PRIVATE_DATA *Private;
527 IPSEC_PAD_ENTRY *PadEntry;
528 UINT8 IkeVersion;
529
530 Private = (UdpService->IpVersion == IP_VERSION_4) ?
531 IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :
532 IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);
533
534 //
535 // Try to open udp io for output if it hasn't.
536 //
537 Status = IkeOpenOutputUdp (UdpService, RemoteIp);
538 if (EFI_ERROR (Status)) {
539 return Status;
540 }
541 //
542 // Try to find the IKE SA session in the IKEv1 and IKEv2 established SA session list.
543 //
544 IkeSaSession = (UINT8 *) Ikev2SaSessionLookup (&Private->Ikev2EstablishedList, RemoteIp);
545
546
547 if (IkeSaSession == NULL) {
548 //
549 // Find the pad entry by the remote ip address.
550 //
551 PadEntry = IpSecLookupPadEntry (UdpService->IpVersion, RemoteIp);
552 if (PadEntry == NULL) {
553 return EFI_ACCESS_DENIED;
554 }
555 //
556 // Determine the IKE exchange instance by the auth protocol in pad entry.
557 //
558 ASSERT (PadEntry->Data->AuthProtocol < EfiIPsecAuthProtocolMaximum);
559 if (PadEntry->Data->AuthProtocol == EfiIPsecAuthProtocolIKEv1) {
560 return EFI_INVALID_PARAMETER;
561 }
562 Exchange = mIkeExchange[PadEntry->Data->AuthProtocol];
563 //
564 // Start the main mode stage to negotiate IKE SA.
565 //
566 Status = Exchange->NegotiateSa (UdpService, SpdEntry, PadEntry, RemoteIp);
567 } else {
568 //
569 // Determine the IKE exchange instance by the IKE version in IKE SA session.
570 //
571 IkeVersion = IkeGetVersionFromSession (IkeSaSession);
572 if (IkeVersion != 2) {
573 return EFI_INVALID_PARAMETER;
574 }
575
576 Exchange = mIkeExchange[IkeVersion - 1];
577 //
578 // Start the quick mode stage to negotiate child SA.
579 //
580 Status = Exchange->NegotiateChildSa (IkeSaSession, SpdEntry, NULL);
581 }
582
583 return Status;
584 }
585
586 /**
587 The generic interface when receive a IKE packet.
588
589 This function is called when UDP IO receives a IKE packet.
590
591 @param[in] Packet Point to received IKE packet.
592 @param[in] EndPoint Point to UDP_END_POINT which contains the information of
593 Remote IP and Port.
594 @param[in] IoStatus The Status of Recieve Token.
595 @param[in] Context Point to data passed from the caller.
596
597 **/
598 VOID
599 EFIAPI
600 IkeDispatch (
601 IN NET_BUF *Packet,
602 IN UDP_END_POINT *EndPoint,
603 IN EFI_STATUS IoStatus,
604 IN VOID *Context
605 )
606 {
607 IPSEC_PRIVATE_DATA *Private;
608 IKE_PACKET *IkePacket;
609 IKE_HEADER *IkeHdr;
610 IKE_UDP_SERVICE *UdpService;
611 IKE_EXCHANGE_INTERFACE *Exchange;
612 EFI_STATUS Status;
613
614 UdpService = (IKE_UDP_SERVICE *) Context;
615 IkePacket = NULL;
616 Private = (UdpService->IpVersion == IP_VERSION_4) ?
617 IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :
618 IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);
619
620 if (EFI_ERROR (IoStatus)) {
621 goto ON_EXIT;
622 }
623 //
624 // Check whether the ipsec is enabled or not.
625 //
626 if (Private->IpSec.DisabledFlag == TRUE) {
627 goto ON_EXIT;
628 }
629
630 if (EndPoint->RemotePort != IKE_DEFAULT_PORT) {
631 goto ON_EXIT;
632 }
633
634 //
635 // Build IKE packet from the received netbuf.
636 //
637 IkePacket = IkePacketFromNetbuf (Packet);
638
639 if (IkePacket == NULL) {
640 goto ON_EXIT;
641 }
642 //
643 // Get the remote address from the IKE packet.
644 //
645 if (UdpService->IpVersion == IP_VERSION_4) {
646 *(UINT32 *) IkePacket->RemotePeerIp.Addr = HTONL ((*(UINT32 *) EndPoint->RemoteAddr.Addr));
647 } else {
648 CopyMem (
649 &IkePacket->RemotePeerIp,
650 NTOHLLL (&EndPoint->RemoteAddr.v6),
651 sizeof (EFI_IPv6_ADDRESS)
652 );
653 }
654 //
655 // Try to open udp io for output if hasn't.
656 //
657 Status = IkeOpenOutputUdp (UdpService, &IkePacket->RemotePeerIp);
658
659 if (EFI_ERROR (Status)) {
660 goto ON_EXIT;
661 }
662
663 IkeHdr = IkePacket->Header;
664
665 //
666 // Determine the IKE exchange instance by the IKE version in IKE header.
667 //
668 if (IKE_MAJOR_VERSION (IkeHdr->Version) == 2) {
669 Exchange = mIkeExchange[IKE_MAJOR_VERSION (IkeHdr->Version) - 1];
670 } else {
671 goto ON_EXIT;
672 }
673
674 switch (IkeHdr->ExchangeType) {
675 case IKE_XCG_TYPE_IDENTITY_PROTECT:
676 case IKE_XCG_TYPE_SA_INIT:
677 case IKE_XCG_TYPE_AUTH:
678 Exchange->HandleSa (UdpService, IkePacket);
679 break;
680
681 case IKE_XCG_TYPE_QM:
682 case IKE_XCG_TYPE_CREATE_CHILD_SA:
683 Exchange->HandleChildSa (UdpService, IkePacket);
684 break;
685
686 case IKE_XCG_TYPE_INFO:
687 case IKE_XCG_TYPE_INFO2:
688 Exchange->HandleInfo (UdpService, IkePacket);
689 break;
690
691 default:
692 break;
693 }
694
695 ON_EXIT:
696 if (IkePacket != NULL) {
697 IkePacketFree (IkePacket);
698 }
699
700 if (Packet != NULL) {
701 NetbufFree (Packet);
702 }
703
704 UdpIoRecvDatagram (UdpService->Input, IkeDispatch, UdpService, 0);
705
706 return ;
707 }
708
709 /**
710 Delete all established IKE SAs and related Child SAs.
711
712 This function is the subfunction of the IpSecCleanupAllSa(). It first calls
713 IkeDeleteChildSa() to delete all Child SAs then send out the related
714 Information packet.
715
716 @param[in] Private Pointer of the IPSEC_PRIVATE_DATA
717 @param[in] IsDisableIpsec Indicate whether needs to disable IPsec.
718
719 **/
720 VOID
721 IkeDeleteAllSas (
722 IN IPSEC_PRIVATE_DATA *Private,
723 IN BOOLEAN IsDisableIpsec
724 )
725 {
726 LIST_ENTRY *Entry;
727 LIST_ENTRY *NextEntry;
728 IKEV2_SA_SESSION *Ikev2SaSession;
729 UINT8 Value;
730 EFI_STATUS Status;
731 IKE_EXCHANGE_INTERFACE *Exchange;
732 UINT8 IkeVersion;
733
734 Exchange = NULL;
735
736 //
737 // If the IKEv1 is supported, first deal with the Ikev1Estatblished list.
738 //
739
740 //
741 // If IKEv2 SAs are under establishing, delete it directly.
742 //
743 if (!IsListEmpty (&Private->Ikev2SessionList)) {
744 NET_LIST_FOR_EACH_SAFE (Entry, NextEntry, &Private->Ikev2SessionList) {
745 Ikev2SaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);
746 RemoveEntryList (Entry);
747 Ikev2SaSessionFree (Ikev2SaSession);
748 }
749 }
750
751 //
752 // If there is no existing established IKE SA, set the Ipsec DisableFlag to TRUE
753 // and turn off the IsIPsecDisabling flag.
754 //
755 if (IsListEmpty (&Private->Ikev2EstablishedList) && IsDisableIpsec) {
756 Value = IPSEC_STATUS_DISABLED;
757 Status = gRT->SetVariable (
758 IPSECCONFIG_STATUS_NAME,
759 &gEfiIpSecConfigProtocolGuid,
760 EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_NON_VOLATILE,
761 sizeof (Value),
762 &Value
763 );
764 if (!EFI_ERROR (Status)) {
765 Private->IpSec.DisabledFlag = TRUE;
766 Private->IsIPsecDisabling = FALSE;
767 return ;
768 }
769 }
770
771 //
772 // Delete established IKEv2 SAs.
773 //
774 if (!IsListEmpty (&Private->Ikev2EstablishedList)) {
775 for (Entry = Private->Ikev2EstablishedList.ForwardLink; Entry != &Private->Ikev2EstablishedList;) {
776 Ikev2SaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);
777 Entry = Entry->ForwardLink;
778
779 Ikev2SaSession->SessionCommon.State = IkeStateSaDeleting;
780
781 //
782 // Call for Information Exchange.
783 //
784 IkeVersion = IkeGetVersionFromSession ((UINT8*)Ikev2SaSession);
785 if (IkeVersion == 2) {
786 Exchange = mIkeExchange[IkeVersion - 1];
787 Exchange->NegotiateInfo((UINT8*)Ikev2SaSession, NULL);
788 }
789 }
790 }
791
792 }
793
794
795