NetworkPkg/IpSecDxe/IkeService.c

   1 /** @file
   2   Provide IPsec Key Exchange (IKE) service general interfaces.
   3
   4   Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>
   5
   6   This program and the accompanying materials
   7   are licensed and made available under the terms and conditions of the BSD License
   8   which accompanies this distribution.  The full text of the license may be found at
   9   http://opensource.org/licenses/bsd-license.php.
  10
  11   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  12   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  13
  14 **/
  15
  16 #include "IkeService.h"
  17 #include "IpSecConfigImpl.h"
  18 #include "Ikev2/Utility.h"
  19
  20 IKE_EXCHANGE_INTERFACE  *mIkeExchange[] = {
  21   &mIkev1Exchange,
  22   &mIkev2Exchange
  23 };
  24
  25 EFI_UDP4_CONFIG_DATA    mUdp4Conf = {
  26   FALSE,
  27   FALSE,
  28   FALSE,
  29   TRUE,
  30   //
  31   // IO parameters
  32   //
  33   0,
  34   64,
  35   FALSE,
  36   0,
  37   1000000,
  38   FALSE,
  39   {{0,0,0,0}},
  40   {{0,0,0,0}},
  41   IKE_DEFAULT_PORT,
  42   {{0,0,0,0}},
  43   0
  44 };
  45
  46 EFI_UDP6_CONFIG_DATA    mUdp6Conf = {
  47   FALSE,
  48   FALSE,
  49   TRUE,
  50   //
  51   // IO parameters
  52   //
  53   0,
  54   128,
  55   0,
  56   1000000,
  57   //Access Point
  58   {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}},
  59   IKE_DEFAULT_PORT,
  60   {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}},
  61   0
  62 };
  63
  64 /**
  65   Check if the NIC handle is binded to a Udp service.
  66
  67   @param[in]  Private    Pointer of IPSEC_PRIVATE_DATA.
  68   @param[in]  Handle     The Handle of the NIC card.
  69   @param[in]  IpVersion  The version of the IP stack.
  70
  71   @return a pointer of IKE_UDP_SERVICE.
  72
  73 **/
  74 IKE_UDP_SERVICE *
  75 IkeLookupUdp (
  76   IN IPSEC_PRIVATE_DATA     *Private,
  77   IN EFI_HANDLE             Handle,
  78   IN UINT8                  IpVersion
  79   )
  80 {
  81   LIST_ENTRY      *Head;
  82   LIST_ENTRY      *Entry;
  83   LIST_ENTRY      *Next;
  84   IKE_UDP_SERVICE *Udp;
  85
  86   Udp   = NULL;
  87   Head  = (IpVersion == IP_VERSION_4) ? &Private->Udp4List : &Private->Udp6List;
  88
  89   NET_LIST_FOR_EACH_SAFE (Entry, Next, Head) {
  90
  91     Udp = IPSEC_UDP_SERVICE_FROM_LIST (Entry);
  92     //
  93     // Find the right udp service which installed on the appointed NIC handle.
  94     //
  95     if (Handle == Udp->NicHandle) {
  96       break;
  97     } else {
  98       Udp = NULL;
  99     }
 100   }
 101
 102   return Udp;
 103 }
 104
 105 /**
 106   Configure a UDPIO's UDP4 instance.
 107
 108   This fuction is called by the UdpIoCreateIo() to configures a
 109   UDP4 instance.
 110
 111   @param[in] UdpIo         The UDP_IO to be configured.
 112   @param[in] Context       User-defined data when calling UdpIoCreateIo().
 113
 114   @retval EFI_SUCCESS      The configuration succeeded.
 115   @retval Others           The UDP4 instance fails to configure.
 116
 117 **/
 118 EFI_STATUS
 119 EFIAPI
 120 IkeConfigUdp4 (
 121   IN UDP_IO                 *UdpIo,
 122   IN VOID                   *Context
 123   )
 124 {
 125   EFI_UDP4_CONFIG_DATA  Udp4Cfg;
 126   EFI_UDP4_PROTOCOL     *Udp4;
 127
 128   ZeroMem (&Udp4Cfg, sizeof (EFI_UDP4_CONFIG_DATA));
 129
 130   Udp4 = UdpIo->Protocol.Udp4;
 131   CopyMem (
 132     &Udp4Cfg,
 133     &mUdp4Conf,
 134     sizeof (EFI_UDP4_CONFIG_DATA)
 135     );
 136
 137   if (Context != NULL) {
 138     //
 139     // Configure udp4 io with local default address.
 140     //
 141     Udp4Cfg.UseDefaultAddress = TRUE;
 142   }
 143
 144   return Udp4->Configure (Udp4, &Udp4Cfg);
 145 }
 146
 147 /**
 148   Configure a UDPIO's UDP6 instance.
 149
 150   This fuction is called by the UdpIoCreateIo()to configure a
 151   UDP6 instance.
 152
 153   @param[in] UdpIo         The UDP_IO to be configured.
 154   @param[in] Context       User-defined data when calling UdpIoCreateIo().
 155
 156   @retval EFI_SUCCESS      The configuration succeeded.
 157   @retval Others           The configuration fails.
 158
 159 **/
 160 EFI_STATUS
 161 EFIAPI
 162 IkeConfigUdp6 (
 163   IN UDP_IO                 *UdpIo,
 164   IN VOID                   *Context
 165   )
 166 {
 167   EFI_UDP6_PROTOCOL     *Udp6;
 168   EFI_UDP6_CONFIG_DATA  Udp6Cfg;
 169
 170   ZeroMem (&Udp6Cfg, sizeof (EFI_UDP6_CONFIG_DATA));
 171
 172   Udp6 = UdpIo->Protocol.Udp6;
 173   CopyMem (
 174     &Udp6Cfg,
 175     &mUdp6Conf,
 176     sizeof (EFI_UDP6_CONFIG_DATA)
 177     );
 178
 179   if (Context != NULL) {
 180     //
 181     // Configure instance with a destination address to start source address
 182     // selection, and then get the configure data from the mode data to store
 183     // the source address.
 184     //
 185     CopyMem (
 186       &Udp6Cfg.RemoteAddress,
 187       Context,
 188       sizeof (EFI_IPv6_ADDRESS)
 189       );
 190   }
 191
 192   return Udp6->Configure (Udp6, &Udp6Cfg);
 193 }
 194
 195 /**
 196   Open and configure the related output UDPIO for IKE packet sending.
 197
 198   If the UdpService is not configured, this fuction calls UdpIoCreatIo() to
 199   create UDPIO to bind this UdpService for IKE packet sending. If the UdpService
 200   has already been configured, then return.
 201
 202   @param[in] UdpService     The UDP_IO to be configured.
 203   @param[in] RemoteIp       User-defined data when calling UdpIoCreateIo().
 204
 205   @retval EFI_SUCCESS      The configuration is successful.
 206   @retval Others           The configuration fails.
 207
 208 **/
 209 EFI_STATUS
 210 IkeOpenOutputUdp (
 211   IN IKE_UDP_SERVICE           *UdpService,
 212   IN EFI_IP_ADDRESS            *RemoteIp
 213   )
 214 {
 215   EFI_STATUS                       Status;
 216   EFI_IP4_CONFIG2_PROTOCOL         *Ip4Cfg2;
 217   EFI_IP4_CONFIG2_INTERFACE_INFO   *IfInfo;
 218   UINTN                            BufSize;
 219   EFI_IP6_MODE_DATA                Ip6ModeData;
 220   EFI_UDP6_PROTOCOL                *Udp6;
 221
 222   Status      = EFI_SUCCESS;
 223   IfInfo      = NULL;
 224   BufSize     = 0;
 225
 226   //
 227   // Check whether the input and output udp io are both configured.
 228   //
 229   if (UdpService->IsConfigured) {
 230     goto ON_EXIT;
 231   }
 232
 233   if (UdpService->IpVersion == UDP_IO_UDP4_VERSION) {
 234     //
 235     // Handle ip4config protocol to get local default address.
 236     //
 237     Status = gBS->HandleProtocol (
 238                     UdpService->NicHandle,
 239                     &gEfiIp4Config2ProtocolGuid,
 240                     (VOID **) &Ip4Cfg2
 241                     );
 242
 243     if (EFI_ERROR (Status)) {
 244       goto ON_EXIT;
 245     }
 246
 247     //
 248     // Get the interface information size.
 249     //
 250     Status = Ip4Cfg2->GetData (
 251                        Ip4Cfg2,
 252                        Ip4Config2DataTypeInterfaceInfo,
 253                        &BufSize,
 254                        NULL
 255                        );
 256
 257     if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {
 258       goto ON_EXIT;
 259     }
 260
 261     IfInfo = AllocateZeroPool (BufSize);
 262
 263     if (IfInfo == NULL) {
 264       Status = EFI_OUT_OF_RESOURCES;
 265       goto ON_EXIT;
 266     }
 267
 268     //
 269     // Get the interface info.
 270     //
 271     Status = Ip4Cfg2->GetData (
 272                        Ip4Cfg2,
 273                        Ip4Config2DataTypeInterfaceInfo,
 274                        &BufSize,
 275                        IfInfo
 276                        );
 277
 278     if (EFI_ERROR (Status)) {
 279       goto ON_EXIT;
 280     }
 281
 282     CopyMem (
 283       &UdpService->DefaultAddress.v4,
 284       &IfInfo->StationAddress,
 285       sizeof (EFI_IPv4_ADDRESS)
 286       );
 287
 288     //
 289     // Create udp4 io for output with local default address.
 290     //
 291     UdpService->Output = UdpIoCreateIo (
 292                            UdpService->NicHandle,
 293                            UdpService->ImageHandle,
 294                            IkeConfigUdp4,
 295                            UDP_IO_UDP4_VERSION,
 296                            &UdpService->DefaultAddress
 297                            );
 298
 299     if (UdpService->Output == NULL) {
 300       Status = EFI_OUT_OF_RESOURCES;
 301       goto ON_EXIT;
 302     }
 303
 304   } else {
 305     //
 306     // Create udp6 io for output with remote address.
 307     //
 308     UdpService->Output = UdpIoCreateIo (
 309                            UdpService->NicHandle,
 310                            UdpService->ImageHandle,
 311                            IkeConfigUdp6,
 312                            UDP_IO_UDP6_VERSION,
 313                            RemoteIp
 314                            );
 315
 316     if (UdpService->Output == NULL) {
 317       Status = EFI_OUT_OF_RESOURCES;
 318       goto ON_EXIT;
 319     }
 320     //
 321     // Get ip6 mode data to get the result of source address selection.
 322     //
 323     ZeroMem (&Ip6ModeData, sizeof (EFI_IP6_MODE_DATA));
 324
 325     Udp6    = UdpService->Output->Protocol.Udp6;
 326     Status  = Udp6->GetModeData (Udp6, NULL, &Ip6ModeData, NULL, NULL);
 327
 328     if (EFI_ERROR (Status)) {
 329       UdpIoFreeIo (UdpService->Output);
 330       goto ON_EXIT;
 331     }
 332     //
 333     // Reconfigure udp6 io without remote address.
 334     //
 335     Udp6->Configure (Udp6, NULL);
 336     Status = IkeConfigUdp6 (UdpService->Output, NULL);
 337
 338     //
 339     // Record the selected source address for ipsec process later.
 340     //
 341     CopyMem (
 342       &UdpService->DefaultAddress.v6,
 343       &Ip6ModeData.ConfigData.StationAddress,
 344       sizeof (EFI_IPv6_ADDRESS)
 345       );
 346   }
 347
 348   UdpService->IsConfigured = TRUE;
 349
 350 ON_EXIT:
 351   if (IfInfo != NULL) {
 352     FreePool (IfInfo);
 353   }
 354
 355   return Status;
 356 }
 357
 358 /**
 359   Open and configure a UDPIO of Udp4 for IKE packet receiving.
 360
 361   This function is called at the IPsecDriverBinding start. IPsec create a UDP4 and
 362   UDP4 IO for each NIC handle.
 363
 364   @param[in] Private        Point to IPSEC_PRIVATE_DATA
 365   @param[in] Controller     Handler for NIC card.
 366   @param[in] ImageHandle    The handle that contains the EFI_DRIVER_BINDING_PROTOCOL instance.
 367
 368   @retval EFI_SUCCESS             The Operation is successful.
 369   @retval EFI_OUT_OF_RESOURCE     The required system resource can't be allocated.
 370
 371 **/
 372 EFI_STATUS
 373 IkeOpenInputUdp4 (
 374   IN IPSEC_PRIVATE_DATA           *Private,
 375   IN EFI_HANDLE                   Controller,
 376   IN EFI_HANDLE                   ImageHandle
 377   )
 378 {
 379   IKE_UDP_SERVICE *Udp4Srv;
 380
 381   //
 382   // Check whether udp4 io of the controller has already been opened.
 383   //
 384   Udp4Srv = IkeLookupUdp (Private, Controller, IP_VERSION_4);
 385
 386   if (Udp4Srv != NULL) {
 387     return EFI_ALREADY_STARTED;
 388   }
 389
 390   Udp4Srv = AllocateZeroPool (sizeof (IKE_UDP_SERVICE));
 391
 392   if (Udp4Srv == NULL) {
 393     return EFI_OUT_OF_RESOURCES;
 394   }
 395   //
 396   // Create udp4 io for iutput.
 397   //
 398   Udp4Srv->Input = UdpIoCreateIo (
 399                      Controller,
 400                      ImageHandle,
 401                      IkeConfigUdp4,
 402                      UDP_IO_UDP4_VERSION,
 403                      NULL
 404                      );
 405
 406   if (Udp4Srv->Input == NULL) {
 407     FreePool (Udp4Srv);
 408     return EFI_OUT_OF_RESOURCES;
 409   }
 410
 411   Udp4Srv->NicHandle    = Controller;
 412   Udp4Srv->ImageHandle  = ImageHandle;
 413   Udp4Srv->ListHead     = &(Private->Udp4List);
 414   Udp4Srv->IpVersion    = UDP_IO_UDP4_VERSION;
 415   Udp4Srv->IsConfigured = FALSE;
 416
 417   ZeroMem (&Udp4Srv->DefaultAddress, sizeof (EFI_IP_ADDRESS));
 418
 419   //
 420   // Insert the udp4 io into the list and increase the count.
 421   //
 422   InsertTailList (&Private->Udp4List, &Udp4Srv->List);
 423
 424   Private->Udp4Num++;
 425
 426   UdpIoRecvDatagram (Udp4Srv->Input, IkeDispatch, Udp4Srv, 0);
 427
 428   return EFI_SUCCESS;
 429 }
 430
 431 /**
 432   Open and configure a UDPIO of Udp6 for IKE packet receiving.
 433
 434   This function is called at the IPsecDriverBinding start. IPsec create a UDP6 and UDP6
 435   IO for each NIC handle.
 436
 437   @param[in] Private        Point to IPSEC_PRIVATE_DATA
 438   @param[in] Controller     Handler for NIC card.
 439   @param[in] ImageHandle    The handle that contains the EFI_DRIVER_BINDING_PROTOCOL instance.
 440
 441   @retval EFI_SUCCESS             The Operation is successful.
 442   @retval EFI_OUT_OF_RESOURCE     The required system resource can't be allocated.
 443
 444 **/
 445 EFI_STATUS
 446 IkeOpenInputUdp6 (
 447   IN IPSEC_PRIVATE_DATA           *Private,
 448   IN EFI_HANDLE                   Controller,
 449   IN EFI_HANDLE                   ImageHandle
 450   )
 451 {
 452   IKE_UDP_SERVICE *Udp6Srv;
 453
 454   Udp6Srv = IkeLookupUdp (Private, Controller, IP_VERSION_6);
 455
 456   if (Udp6Srv != NULL) {
 457     return EFI_ALREADY_STARTED;
 458   }
 459
 460   Udp6Srv = AllocateZeroPool (sizeof (IKE_UDP_SERVICE));
 461
 462   if (Udp6Srv == NULL) {
 463     return EFI_OUT_OF_RESOURCES;
 464   }
 465   //
 466   // Create udp6 io for input.
 467   //
 468   Udp6Srv->Input = UdpIoCreateIo (
 469                      Controller,
 470                      ImageHandle,
 471                      IkeConfigUdp6,
 472                      UDP_IO_UDP6_VERSION,
 473                      NULL
 474                      );
 475
 476   if (Udp6Srv->Input == NULL) {
 477     FreePool (Udp6Srv);
 478     return EFI_OUT_OF_RESOURCES;
 479   }
 480
 481   Udp6Srv->NicHandle    = Controller;
 482   Udp6Srv->ImageHandle  = ImageHandle;
 483   Udp6Srv->ListHead     = &(Private->Udp6List);
 484   Udp6Srv->IpVersion    = UDP_IO_UDP6_VERSION;
 485   Udp6Srv->IsConfigured = FALSE;
 486
 487   ZeroMem (&Udp6Srv->DefaultAddress, sizeof (EFI_IP_ADDRESS));
 488
 489   //
 490   // Insert the udp6 io into the list and increase the count.
 491   //
 492   InsertTailList (&Private->Udp6List, &Udp6Srv->List);
 493
 494   Private->Udp6Num++;
 495
 496   UdpIoRecvDatagram (Udp6Srv->Input, IkeDispatch, Udp6Srv, 0);
 497
 498   return EFI_SUCCESS;
 499 }
 500
 501 /**
 502   The general interface of starting IPsec Key Exchange.
 503
 504   This function is called when a IKE negotiation to start getting a Key.
 505
 506   @param[in] UdpService   Point to IKE_UDP_SERVICE which will be used for
 507                           IKE packet sending.
 508   @param[in] SpdEntry     Point to the SPD entry related to the IKE negotiation.
 509   @param[in] RemoteIp     Point to EFI_IP_ADDRESS related to the IKE negotiation.
 510
 511   @retval EFI_SUCCESS            The Operation is successful.
 512   @retval EFI_ACCESS_DENIED      No related PAD entry was found.
 513   @retval EFI_INVALID_PARAMETER  The IKE version is not supported.
 514
 515 **/
 516 EFI_STATUS
 517 IkeNegotiate (
 518   IN IKE_UDP_SERVICE       *UdpService,
 519   IN IPSEC_SPD_ENTRY       *SpdEntry,
 520   IN EFI_IP_ADDRESS        *RemoteIp
 521   )
 522 {
 523   EFI_STATUS               Status;
 524   UINT8                    *IkeSaSession;
 525   IKE_EXCHANGE_INTERFACE   *Exchange;
 526   IPSEC_PRIVATE_DATA       *Private;
 527   IPSEC_PAD_ENTRY          *PadEntry;
 528   UINT8                    IkeVersion;
 529
 530   Private = (UdpService->IpVersion == IP_VERSION_4) ?
 531              IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :
 532              IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);
 533
 534   //
 535   // Try to open udp io for output if it hasn't.
 536   //
 537   Status = IkeOpenOutputUdp (UdpService, RemoteIp);
 538   if (EFI_ERROR (Status)) {
 539     return Status;
 540   }
 541   //
 542   // Try to find the IKE SA session in the IKEv1 and IKEv2 established SA session list.
 543   //
 544   IkeSaSession = (UINT8 *) Ikev2SaSessionLookup (&Private->Ikev2EstablishedList, RemoteIp);
 545
 546
 547   if (IkeSaSession == NULL) {
 548     //
 549     // Find the pad entry by the remote ip address.
 550     //
 551     PadEntry = IpSecLookupPadEntry (UdpService->IpVersion, RemoteIp);
 552     if (PadEntry == NULL) {
 553       return EFI_ACCESS_DENIED;
 554     }
 555     //
 556     // Determine the IKE exchange instance by the auth protocol in pad entry.
 557     //
 558     ASSERT (PadEntry->Data->AuthProtocol < EfiIPsecAuthProtocolMaximum);
 559     if (PadEntry->Data->AuthProtocol == EfiIPsecAuthProtocolIKEv1) {
 560       return EFI_INVALID_PARAMETER;
 561     }
 562     Exchange = mIkeExchange[PadEntry->Data->AuthProtocol];
 563     //
 564     // Start the main mode stage to negotiate IKE SA.
 565     //
 566     Status = Exchange->NegotiateSa (UdpService, SpdEntry, PadEntry, RemoteIp);
 567   } else {
 568     //
 569     // Determine the IKE exchange instance by the IKE version in IKE SA session.
 570     //
 571     IkeVersion = IkeGetVersionFromSession (IkeSaSession);
 572     if (IkeVersion != 2) {
 573       return EFI_INVALID_PARAMETER;
 574     }
 575
 576     Exchange = mIkeExchange[IkeVersion - 1];
 577     //
 578     // Start the quick mode stage to negotiate child SA.
 579     //
 580     Status = Exchange->NegotiateChildSa (IkeSaSession, SpdEntry, NULL);
 581   }
 582
 583   return Status;
 584 }
 585
 586 /**
 587   The generic interface when receive a IKE packet.
 588
 589   This function is called when UDP IO receives a IKE packet.
 590
 591   @param[in] Packet       Point to received IKE packet.
 592   @param[in] EndPoint     Point to UDP_END_POINT which contains the information of
 593                           Remote IP and Port.
 594   @param[in] IoStatus     The Status of Recieve Token.
 595   @param[in] Context      Point to data passed from the caller.
 596
 597 **/
 598 VOID
 599 EFIAPI
 600 IkeDispatch (
 601   IN NET_BUF                        *Packet,
 602   IN UDP_END_POINT                  *EndPoint,
 603   IN EFI_STATUS                     IoStatus,
 604   IN VOID                           *Context
 605   )
 606 {
 607   IPSEC_PRIVATE_DATA                *Private;
 608   IKE_PACKET                        *IkePacket;
 609   IKE_HEADER                        *IkeHdr;
 610   IKE_UDP_SERVICE                   *UdpService;
 611   IKE_EXCHANGE_INTERFACE            *Exchange;
 612   EFI_STATUS                        Status;
 613
 614   UdpService = (IKE_UDP_SERVICE *) Context;
 615   IkePacket  = NULL;
 616   Private    = (UdpService->IpVersion == IP_VERSION_4) ?
 617                IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :
 618                IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);
 619
 620   if (EFI_ERROR (IoStatus)) {
 621     goto ON_EXIT;
 622   }
 623   //
 624   // Check whether the ipsec is enabled or not.
 625   //
 626   if (Private->IpSec.DisabledFlag == TRUE) {
 627     goto ON_EXIT;
 628   }
 629
 630   if (EndPoint->RemotePort != IKE_DEFAULT_PORT) {
 631     goto ON_EXIT;
 632   }
 633
 634   //
 635   // Build IKE packet from the received netbuf.
 636   //
 637   IkePacket = IkePacketFromNetbuf (Packet);
 638
 639   if (IkePacket == NULL) {
 640     goto ON_EXIT;
 641   }
 642   //
 643   // Get the remote address from the IKE packet.
 644   //
 645   if (UdpService->IpVersion == IP_VERSION_4) {
 646     *(UINT32 *) IkePacket->RemotePeerIp.Addr = HTONL ((*(UINT32 *) EndPoint->RemoteAddr.Addr));
 647   } else {
 648     CopyMem (
 649       &IkePacket->RemotePeerIp,
 650       NTOHLLL (&EndPoint->RemoteAddr.v6),
 651       sizeof (EFI_IPv6_ADDRESS)
 652       );
 653   }
 654   //
 655   // Try to open udp io for output if hasn't.
 656   //
 657   Status = IkeOpenOutputUdp (UdpService, &IkePacket->RemotePeerIp);
 658
 659   if (EFI_ERROR (Status)) {
 660     goto ON_EXIT;
 661   }
 662
 663   IkeHdr = IkePacket->Header;
 664
 665   //
 666   // Determine the IKE exchange instance by the IKE version in IKE header.
 667   //
 668   if (IKE_MAJOR_VERSION (IkeHdr->Version) == 2) {
 669     Exchange = mIkeExchange[IKE_MAJOR_VERSION (IkeHdr->Version) - 1];
 670   } else {
 671     goto ON_EXIT;
 672   }
 673
 674   switch (IkeHdr->ExchangeType) {
 675   case IKE_XCG_TYPE_IDENTITY_PROTECT:
 676   case IKE_XCG_TYPE_SA_INIT:
 677   case IKE_XCG_TYPE_AUTH:
 678     Exchange->HandleSa (UdpService, IkePacket);
 679     break;
 680
 681   case IKE_XCG_TYPE_QM:
 682   case IKE_XCG_TYPE_CREATE_CHILD_SA:
 683     Exchange->HandleChildSa (UdpService, IkePacket);
 684     break;
 685
 686   case IKE_XCG_TYPE_INFO:
 687   case IKE_XCG_TYPE_INFO2:
 688     Exchange->HandleInfo (UdpService, IkePacket);
 689     break;
 690
 691   default:
 692     break;
 693   }
 694
 695 ON_EXIT:
 696   if (IkePacket != NULL) {
 697     IkePacketFree (IkePacket);
 698   }
 699
 700   if (Packet != NULL) {
 701     NetbufFree (Packet);
 702   }
 703
 704   UdpIoRecvDatagram (UdpService->Input, IkeDispatch, UdpService, 0);
 705
 706   return ;
 707 }
 708
 709 /**
 710   Delete all established IKE SAs and related Child SAs.
 711
 712   This function is the subfunction of the IpSecCleanupAllSa(). It first calls
 713   IkeDeleteChildSa() to delete all Child SAs then send out the related
 714   Information packet.
 715
 716   @param[in]  Private           Pointer of the IPSEC_PRIVATE_DATA
 717   @param[in]  IsDisableIpsec    Indicate whether needs to disable IPsec.
 718
 719 **/
 720 VOID
 721 IkeDeleteAllSas (
 722   IN IPSEC_PRIVATE_DATA  *Private,
 723   IN BOOLEAN             IsDisableIpsec
 724   )
 725 {
 726   LIST_ENTRY             *Entry;
 727   LIST_ENTRY             *NextEntry;
 728   IKEV2_SA_SESSION       *Ikev2SaSession;
 729   UINT8                  Value;
 730   EFI_STATUS             Status;
 731   IKE_EXCHANGE_INTERFACE *Exchange;
 732   UINT8                  IkeVersion;
 733
 734   Exchange = NULL;
 735
 736   //
 737   // If the IKEv1 is supported, first deal with the Ikev1Estatblished list.
 738   //
 739
 740   //
 741   // If IKEv2 SAs are under establishing, delete it directly.
 742   //
 743   if (!IsListEmpty (&Private->Ikev2SessionList)) {
 744     NET_LIST_FOR_EACH_SAFE (Entry, NextEntry, &Private->Ikev2SessionList) {
 745       Ikev2SaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);
 746       RemoveEntryList (Entry);
 747       Ikev2SaSessionFree (Ikev2SaSession);
 748     }
 749   }
 750
 751   //
 752   // If there is no existing established IKE SA, set the Ipsec DisableFlag to TRUE
 753   // and turn off the IsIPsecDisabling flag.
 754   //
 755   if (IsListEmpty (&Private->Ikev2EstablishedList) && IsDisableIpsec) {
 756     Value = IPSEC_STATUS_DISABLED;
 757     Status = gRT->SetVariable (
 758                IPSECCONFIG_STATUS_NAME,
 759                &gEfiIpSecConfigProtocolGuid,
 760                EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_NON_VOLATILE,
 761                sizeof (Value),
 762                &Value
 763                );
 764     if (!EFI_ERROR (Status)) {
 765       Private->IpSec.DisabledFlag = TRUE;
 766       Private->IsIPsecDisabling   = FALSE;
 767       return ;
 768     }
 769   }
 770
 771   //
 772   // Delete established IKEv2 SAs.
 773   //
 774   if (!IsListEmpty (&Private->Ikev2EstablishedList)) {
 775     for (Entry = Private->Ikev2EstablishedList.ForwardLink; Entry != &Private->Ikev2EstablishedList;) {
 776       Ikev2SaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);
 777       Entry = Entry->ForwardLink;
 778
 779       Ikev2SaSession->SessionCommon.State = IkeStateSaDeleting;
 780
 781       //
 782       // Call for Information Exchange.
 783       //
 784       IkeVersion = IkeGetVersionFromSession ((UINT8*)Ikev2SaSession);
 785       if (IkeVersion == 2) {
 786         Exchange = mIkeExchange[IkeVersion - 1];
 787         Exchange->NegotiateInfo((UINT8*)Ikev2SaSession, NULL);
 788       }
 789     }
 790   }
 791
 792 }
 793
 794
 795