NetworkPkg/IpSecDxe/IkeService.c

   1 /** @file
   2   Provide IPsec Key Exchange (IKE) service general interfaces.
   3
   4   Copyright (c) 2010 - 2013, Intel Corporation. All rights reserved.<BR>
   5
   6   This program and the accompanying materials
   7   are licensed and made available under the terms and conditions of the BSD License
   8   which accompanies this distribution.  The full text of the license may be found at
   9   http://opensource.org/licenses/bsd-license.php.
  10
  11   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  12   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  13
  14 **/
  15
  16 #include "IkeService.h"
  17 #include "IpSecConfigImpl.h"
  18 #include "Ikev2/Utility.h"
  19
  20 IKE_EXCHANGE_INTERFACE  *mIkeExchange[] = {
  21   &mIkev1Exchange,
  22   &mIkev2Exchange
  23 };
  24
  25 EFI_UDP4_CONFIG_DATA    mUdp4Conf = {
  26   FALSE,
  27   FALSE,
  28   FALSE,
  29   TRUE,
  30   //
  31   // IO parameters
  32   //
  33   0,
  34   64,
  35   FALSE,
  36   0,
  37   1000000,
  38   FALSE,
  39   {{0,0,0,0}},
  40   {{0,0,0,0}},
  41   IKE_DEFAULT_PORT,
  42   {{0,0,0,0}},
  43   0
  44 };
  45
  46 EFI_UDP6_CONFIG_DATA    mUdp6Conf = {
  47   FALSE,
  48   FALSE,
  49   TRUE,
  50   //
  51   // IO parameters
  52   //
  53   0,
  54   128,
  55   0,
  56   1000000,
  57   //Access Point
  58   {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}},
  59   IKE_DEFAULT_PORT,
  60   {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}},
  61   0
  62 };
  63
  64 /**
  65   Check if the NIC handle is binded to a Udp service.
  66
  67   @param[in]  Private    Pointer of IPSEC_PRIVATE_DATA.
  68   @param[in]  Handle     The Handle of the NIC card.
  69   @param[in]  IpVersion  The version of the IP stack.
  70
  71   @return a pointer of IKE_UDP_SERVICE.
  72
  73 **/
  74 IKE_UDP_SERVICE *
  75 IkeLookupUdp (
  76   IN IPSEC_PRIVATE_DATA     *Private,
  77   IN EFI_HANDLE             Handle,
  78   IN UINT8                  IpVersion
  79   )
  80 {
  81   LIST_ENTRY      *Head;
  82   LIST_ENTRY      *Entry;
  83   LIST_ENTRY      *Next;
  84   IKE_UDP_SERVICE *Udp;
  85
  86   Udp   = NULL;
  87   Head  = (IpVersion == IP_VERSION_4) ? &Private->Udp4List : &Private->Udp6List;
  88
  89   NET_LIST_FOR_EACH_SAFE (Entry, Next, Head) {
  90
  91     Udp = IPSEC_UDP_SERVICE_FROM_LIST (Entry);
  92     //
  93     // Find the right udp service which installed on the appointed NIC handle.
  94     //
  95     if (Handle == Udp->NicHandle) {
  96       break;
  97     } else {
  98       Udp = NULL;
  99     }
 100   }
 101
 102   return Udp;
 103 }
 104
 105 /**
 106   Configure a UDPIO's UDP4 instance.
 107
 108   This fuction is called by the UdpIoCreateIo() to configures a
 109   UDP4 instance.
 110
 111   @param[in] UdpIo         The UDP_IO to be configured.
 112   @param[in] Context       User-defined data when calling UdpIoCreateIo().
 113
 114   @retval EFI_SUCCESS      The configuration succeeded.
 115   @retval Others           The UDP4 instance fails to configure.
 116
 117 **/
 118 EFI_STATUS
 119 EFIAPI
 120 IkeConfigUdp4 (
 121   IN UDP_IO                 *UdpIo,
 122   IN VOID                   *Context
 123   )
 124 {
 125   EFI_UDP4_CONFIG_DATA  Udp4Cfg;
 126   EFI_UDP4_PROTOCOL     *Udp4;
 127
 128   ZeroMem (&Udp4Cfg, sizeof (EFI_UDP4_CONFIG_DATA));
 129
 130   Udp4 = UdpIo->Protocol.Udp4;
 131   CopyMem (
 132     &Udp4Cfg,
 133     &mUdp4Conf,
 134     sizeof (EFI_UDP4_CONFIG_DATA)
 135     );
 136
 137   if (Context != NULL) {
 138     //
 139     // Configure udp4 io with local default address.
 140     //
 141     Udp4Cfg.UseDefaultAddress = TRUE;
 142   }
 143
 144   return Udp4->Configure (Udp4, &Udp4Cfg);
 145 }
 146
 147 /**
 148   Configure a UDPIO's UDP6 instance.
 149
 150   This fuction is called by the UdpIoCreateIo()to configure a
 151   UDP6 instance.
 152
 153   @param[in] UdpIo         The UDP_IO to be configured.
 154   @param[in] Context       User-defined data when calling UdpIoCreateIo().
 155
 156   @retval EFI_SUCCESS      The configuration succeeded.
 157   @retval Others           The configuration fails.
 158
 159 **/
 160 EFI_STATUS
 161 EFIAPI
 162 IkeConfigUdp6 (
 163   IN UDP_IO                 *UdpIo,
 164   IN VOID                   *Context
 165   )
 166 {
 167   EFI_UDP6_PROTOCOL     *Udp6;
 168   EFI_UDP6_CONFIG_DATA  Udp6Cfg;
 169
 170   ZeroMem (&Udp6Cfg, sizeof (EFI_UDP6_CONFIG_DATA));
 171
 172   Udp6 = UdpIo->Protocol.Udp6;
 173   CopyMem (
 174     &Udp6Cfg,
 175     &mUdp6Conf,
 176     sizeof (EFI_UDP6_CONFIG_DATA)
 177     );
 178
 179   if (Context != NULL) {
 180     //
 181     // Configure instance with a destination address to start source address
 182     // selection, and then get the configure data from the mode data to store
 183     // the source address.
 184     //
 185     CopyMem (
 186       &Udp6Cfg.RemoteAddress,
 187       Context,
 188       sizeof (EFI_IPv6_ADDRESS)
 189       );
 190   }
 191
 192   return Udp6->Configure (Udp6, &Udp6Cfg);
 193 }
 194
 195 /**
 196   Open and configure the related output UDPIO for IKE packet sending.
 197
 198   If the UdpService is not configured, this fuction calls UdpIoCreatIo() to
 199   create UDPIO to bind this UdpService for IKE packet sending. If the UdpService
 200   has already been configured, then return.
 201
 202   @param[in] UdpService     The UDP_IO to be configured.
 203   @param[in] RemoteIp       User-defined data when calling UdpIoCreateIo().
 204
 205   @retval EFI_SUCCESS      The configuration is successful.
 206   @retval Others           The configuration fails.
 207
 208 **/
 209 EFI_STATUS
 210 IkeOpenOutputUdp (
 211   IN IKE_UDP_SERVICE           *UdpService,
 212   IN EFI_IP_ADDRESS            *RemoteIp
 213   )
 214 {
 215   EFI_STATUS              Status;
 216   EFI_IP4_CONFIG_PROTOCOL *Ip4Cfg;
 217   EFI_IP4_IPCONFIG_DATA   *Ip4CfgData;
 218   UINTN                   BufSize;
 219   EFI_IP6_MODE_DATA       Ip6ModeData;
 220   EFI_UDP6_PROTOCOL       *Udp6;
 221
 222   Status      = EFI_SUCCESS;
 223   Ip4CfgData  = NULL;
 224   BufSize     = 0;
 225
 226   //
 227   // Check whether the input and output udp io are both configured.
 228   //
 229   if (UdpService->IsConfigured) {
 230     goto ON_EXIT;
 231   }
 232
 233   if (UdpService->IpVersion == UDP_IO_UDP4_VERSION) {
 234     //
 235     // Handle ip4config protocol to get local default address.
 236     //
 237     Status = gBS->HandleProtocol (
 238                     UdpService->NicHandle,
 239                     &gEfiIp4ConfigProtocolGuid,
 240                     (VOID **) &Ip4Cfg
 241                     );
 242
 243     if (EFI_ERROR (Status)) {
 244       goto ON_EXIT;
 245     }
 246
 247     Status = Ip4Cfg->GetData (Ip4Cfg, &BufSize, NULL);
 248
 249     if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {
 250       goto ON_EXIT;
 251     }
 252
 253     Ip4CfgData = AllocateZeroPool (BufSize);
 254
 255     if (Ip4CfgData == NULL) {
 256       Status = EFI_OUT_OF_RESOURCES;
 257       goto ON_EXIT;
 258     }
 259
 260     Status = Ip4Cfg->GetData (Ip4Cfg, &BufSize, Ip4CfgData);
 261     if (EFI_ERROR (Status)) {
 262       goto ON_EXIT;
 263     }
 264
 265     CopyMem (
 266       &UdpService->DefaultAddress.v4,
 267       &Ip4CfgData->StationAddress,
 268       sizeof (EFI_IPv4_ADDRESS)
 269       );
 270
 271     //
 272     // Create udp4 io for output with local default address.
 273     //
 274     UdpService->Output = UdpIoCreateIo (
 275                            UdpService->NicHandle,
 276                            UdpService->ImageHandle,
 277                            IkeConfigUdp4,
 278                            UDP_IO_UDP4_VERSION,
 279                            &UdpService->DefaultAddress
 280                            );
 281
 282     if (UdpService->Output == NULL) {
 283       Status = EFI_OUT_OF_RESOURCES;
 284       goto ON_EXIT;
 285     }
 286
 287   } else {
 288     //
 289     // Create udp6 io for output with remote address.
 290     //
 291     UdpService->Output = UdpIoCreateIo (
 292                            UdpService->NicHandle,
 293                            UdpService->ImageHandle,
 294                            IkeConfigUdp6,
 295                            UDP_IO_UDP6_VERSION,
 296                            RemoteIp
 297                            );
 298
 299     if (UdpService->Output == NULL) {
 300       Status = EFI_OUT_OF_RESOURCES;
 301       goto ON_EXIT;
 302     }
 303     //
 304     // Get ip6 mode data to get the result of source address selection.
 305     //
 306     ZeroMem (&Ip6ModeData, sizeof (EFI_IP6_MODE_DATA));
 307
 308     Udp6    = UdpService->Output->Protocol.Udp6;
 309     Status  = Udp6->GetModeData (Udp6, NULL, &Ip6ModeData, NULL, NULL);
 310
 311     if (EFI_ERROR (Status)) {
 312       UdpIoFreeIo (UdpService->Output);
 313       goto ON_EXIT;
 314     }
 315     //
 316     // Reconfigure udp6 io without remote address.
 317     //
 318     Udp6->Configure (Udp6, NULL);
 319     Status = IkeConfigUdp6 (UdpService->Output, NULL);
 320
 321     //
 322     // Record the selected source address for ipsec process later.
 323     //
 324     CopyMem (
 325       &UdpService->DefaultAddress.v6,
 326       &Ip6ModeData.ConfigData.StationAddress,
 327       sizeof (EFI_IPv6_ADDRESS)
 328       );
 329   }
 330
 331   UdpService->IsConfigured = TRUE;
 332
 333 ON_EXIT:
 334   if (Ip4CfgData != NULL) {
 335     FreePool (Ip4CfgData);
 336   }
 337
 338   return Status;
 339 }
 340
 341 /**
 342   Open and configure a UDPIO of Udp4 for IKE packet receiving.
 343
 344   This function is called at the IPsecDriverBinding start. IPsec create a UDP4 and
 345   UDP4 IO for each NIC handle.
 346
 347   @param[in] Private        Point to IPSEC_PRIVATE_DATA
 348   @param[in] Controller     Handler for NIC card.
 349   @param[in] ImageHandle    The handle that contains the EFI_DRIVER_BINDING_PROTOCOL instance.
 350
 351   @retval EFI_SUCCESS             The Operation is successful.
 352   @retval EFI_OUT_OF_RESOURCE     The required system resource can't be allocated.
 353
 354 **/
 355 EFI_STATUS
 356 IkeOpenInputUdp4 (
 357   IN IPSEC_PRIVATE_DATA           *Private,
 358   IN EFI_HANDLE                   Controller,
 359   IN EFI_HANDLE                   ImageHandle
 360   )
 361 {
 362   IKE_UDP_SERVICE *Udp4Srv;
 363
 364   //
 365   // Check whether udp4 io of the controller has already been opened.
 366   //
 367   Udp4Srv = IkeLookupUdp (Private, Controller, IP_VERSION_4);
 368
 369   if (Udp4Srv != NULL) {
 370     return EFI_ALREADY_STARTED;
 371   }
 372
 373   Udp4Srv = AllocateZeroPool (sizeof (IKE_UDP_SERVICE));
 374
 375   if (Udp4Srv == NULL) {
 376     return EFI_OUT_OF_RESOURCES;
 377   }
 378   //
 379   // Create udp4 io for iutput.
 380   //
 381   Udp4Srv->Input = UdpIoCreateIo (
 382                      Controller,
 383                      ImageHandle,
 384                      IkeConfigUdp4,
 385                      UDP_IO_UDP4_VERSION,
 386                      NULL
 387                      );
 388
 389   if (Udp4Srv->Input == NULL) {
 390     FreePool (Udp4Srv);
 391     return EFI_OUT_OF_RESOURCES;
 392   }
 393
 394   Udp4Srv->NicHandle    = Controller;
 395   Udp4Srv->ImageHandle  = ImageHandle;
 396   Udp4Srv->ListHead     = &(Private->Udp4List);
 397   Udp4Srv->IpVersion    = UDP_IO_UDP4_VERSION;
 398   Udp4Srv->IsConfigured = FALSE;
 399
 400   ZeroMem (&Udp4Srv->DefaultAddress, sizeof (EFI_IP_ADDRESS));
 401
 402   //
 403   // Insert the udp4 io into the list and increase the count.
 404   //
 405   InsertTailList (&Private->Udp4List, &Udp4Srv->List);
 406
 407   Private->Udp4Num++;
 408
 409   UdpIoRecvDatagram (Udp4Srv->Input, IkeDispatch, Udp4Srv, 0);
 410
 411   return EFI_SUCCESS;
 412 }
 413
 414 /**
 415   Open and configure a UDPIO of Udp6 for IKE packet receiving.
 416
 417   This function is called at the IPsecDriverBinding start. IPsec create a UDP6 and UDP6
 418   IO for each NIC handle.
 419
 420   @param[in] Private        Point to IPSEC_PRIVATE_DATA
 421   @param[in] Controller     Handler for NIC card.
 422   @param[in] ImageHandle    The handle that contains the EFI_DRIVER_BINDING_PROTOCOL instance.
 423
 424   @retval EFI_SUCCESS             The Operation is successful.
 425   @retval EFI_OUT_OF_RESOURCE     The required system resource can't be allocated.
 426
 427 **/
 428 EFI_STATUS
 429 IkeOpenInputUdp6 (
 430   IN IPSEC_PRIVATE_DATA           *Private,
 431   IN EFI_HANDLE                   Controller,
 432   IN EFI_HANDLE                   ImageHandle
 433   )
 434 {
 435   IKE_UDP_SERVICE *Udp6Srv;
 436
 437   Udp6Srv = IkeLookupUdp (Private, Controller, IP_VERSION_6);
 438
 439   if (Udp6Srv != NULL) {
 440     return EFI_ALREADY_STARTED;
 441   }
 442
 443   Udp6Srv = AllocateZeroPool (sizeof (IKE_UDP_SERVICE));
 444
 445   if (Udp6Srv == NULL) {
 446     return EFI_OUT_OF_RESOURCES;
 447   }
 448   //
 449   // Create udp6 io for input.
 450   //
 451   Udp6Srv->Input = UdpIoCreateIo (
 452                      Controller,
 453                      ImageHandle,
 454                      IkeConfigUdp6,
 455                      UDP_IO_UDP6_VERSION,
 456                      NULL
 457                      );
 458
 459   if (Udp6Srv->Input == NULL) {
 460     FreePool (Udp6Srv);
 461     return EFI_OUT_OF_RESOURCES;
 462   }
 463
 464   Udp6Srv->NicHandle    = Controller;
 465   Udp6Srv->ImageHandle  = ImageHandle;
 466   Udp6Srv->ListHead     = &(Private->Udp6List);
 467   Udp6Srv->IpVersion    = UDP_IO_UDP6_VERSION;
 468   Udp6Srv->IsConfigured = FALSE;
 469
 470   ZeroMem (&Udp6Srv->DefaultAddress, sizeof (EFI_IP_ADDRESS));
 471
 472   //
 473   // Insert the udp6 io into the list and increase the count.
 474   //
 475   InsertTailList (&Private->Udp6List, &Udp6Srv->List);
 476
 477   Private->Udp6Num++;
 478
 479   UdpIoRecvDatagram (Udp6Srv->Input, IkeDispatch, Udp6Srv, 0);
 480
 481   return EFI_SUCCESS;
 482 }
 483
 484 /**
 485   The general interface of starting IPsec Key Exchange.
 486
 487   This function is called when a IKE negotiation to start getting a Key.
 488
 489   @param[in] UdpService   Point to IKE_UDP_SERVICE which will be used for
 490                           IKE packet sending.
 491   @param[in] SpdEntry     Point to the SPD entry related to the IKE negotiation.
 492   @param[in] RemoteIp     Point to EFI_IP_ADDRESS related to the IKE negotiation.
 493
 494   @retval EFI_SUCCESS            The Operation is successful.
 495   @retval EFI_ACCESS_DENIED      No related PAD entry was found.
 496   @retval EFI_INVALID_PARAMETER  The IKE version is not supported.
 497
 498 **/
 499 EFI_STATUS
 500 IkeNegotiate (
 501   IN IKE_UDP_SERVICE       *UdpService,
 502   IN IPSEC_SPD_ENTRY       *SpdEntry,
 503   IN EFI_IP_ADDRESS        *RemoteIp
 504   )
 505 {
 506   EFI_STATUS               Status;
 507   UINT8                    *IkeSaSession;
 508   IKE_EXCHANGE_INTERFACE   *Exchange;
 509   IPSEC_PRIVATE_DATA       *Private;
 510   IPSEC_PAD_ENTRY          *PadEntry;
 511   UINT8                    IkeVersion;
 512
 513   Private = (UdpService->IpVersion == IP_VERSION_4) ?
 514              IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :
 515              IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);
 516
 517   //
 518   // Try to open udp io for output if it hasn't.
 519   //
 520   Status = IkeOpenOutputUdp (UdpService, RemoteIp);
 521   if (EFI_ERROR (Status)) {
 522     return Status;
 523   }
 524   //
 525   // Try to find the IKE SA session in the IKEv1 and IKEv2 established SA session list.
 526   //
 527   IkeSaSession = (UINT8 *) Ikev2SaSessionLookup (&Private->Ikev2EstablishedList, RemoteIp);
 528
 529
 530   if (IkeSaSession == NULL) {
 531     //
 532     // Find the pad entry by the remote ip address.
 533     //
 534     PadEntry = IpSecLookupPadEntry (UdpService->IpVersion, RemoteIp);
 535     if (PadEntry == NULL) {
 536       return EFI_ACCESS_DENIED;
 537     }
 538     //
 539     // Determine the IKE exchange instance by the auth protocol in pad entry.
 540     //
 541     ASSERT (PadEntry->Data->AuthProtocol < EfiIPsecAuthProtocolMaximum);
 542     if (PadEntry->Data->AuthProtocol == EfiIPsecAuthProtocolIKEv1) {
 543       return EFI_INVALID_PARAMETER;
 544     }
 545     Exchange = mIkeExchange[PadEntry->Data->AuthProtocol];
 546     //
 547     // Start the main mode stage to negotiate IKE SA.
 548     //
 549     Status = Exchange->NegotiateSa (UdpService, SpdEntry, PadEntry, RemoteIp);
 550   } else {
 551     //
 552     // Determine the IKE exchange instance by the IKE version in IKE SA session.
 553     //
 554     IkeVersion = IkeGetVersionFromSession (IkeSaSession);
 555     if (IkeVersion != 2) {
 556       return EFI_INVALID_PARAMETER;
 557     }
 558
 559     Exchange = mIkeExchange[IkeVersion - 1];
 560     //
 561     // Start the quick mode stage to negotiate child SA.
 562     //
 563     Status = Exchange->NegotiateChildSa (IkeSaSession, SpdEntry, NULL);
 564   }
 565
 566   return Status;
 567 }
 568
 569 /**
 570   The generic interface when receive a IKE packet.
 571
 572   This function is called when UDP IO receives a IKE packet.
 573
 574   @param[in] Packet       Point to received IKE packet.
 575   @param[in] EndPoint     Point to UDP_END_POINT which contains the information of
 576                           Remote IP and Port.
 577   @param[in] IoStatus     The Status of Recieve Token.
 578   @param[in] Context      Point to data passed from the caller.
 579
 580 **/
 581 VOID
 582 EFIAPI
 583 IkeDispatch (
 584   IN NET_BUF                        *Packet,
 585   IN UDP_END_POINT                  *EndPoint,
 586   IN EFI_STATUS                     IoStatus,
 587   IN VOID                           *Context
 588   )
 589 {
 590   IPSEC_PRIVATE_DATA                *Private;
 591   IKE_PACKET                        *IkePacket;
 592   IKE_HEADER                        *IkeHdr;
 593   IKE_UDP_SERVICE                   *UdpService;
 594   IKE_EXCHANGE_INTERFACE            *Exchange;
 595   EFI_STATUS                        Status;
 596
 597   UdpService = (IKE_UDP_SERVICE *) Context;
 598   IkePacket  = NULL;
 599   Private    = (UdpService->IpVersion == IP_VERSION_4) ?
 600                IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :
 601                IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);
 602
 603   if (EFI_ERROR (IoStatus)) {
 604     goto ON_EXIT;
 605   }
 606   //
 607   // Check whether the ipsec is enabled or not.
 608   //
 609   if (Private->IpSec.DisabledFlag == TRUE) {
 610     goto ON_EXIT;
 611   }
 612
 613   if (EndPoint->RemotePort != IKE_DEFAULT_PORT) {
 614     goto ON_EXIT;
 615   }
 616
 617   //
 618   // Build IKE packet from the received netbuf.
 619   //
 620   IkePacket = IkePacketFromNetbuf (Packet);
 621
 622   if (IkePacket == NULL) {
 623     goto ON_EXIT;
 624   }
 625   //
 626   // Get the remote address from the IKE packet.
 627   //
 628   if (UdpService->IpVersion == IP_VERSION_4) {
 629     *(UINT32 *) IkePacket->RemotePeerIp.Addr = HTONL ((*(UINT32 *) EndPoint->RemoteAddr.Addr));
 630   } else {
 631     CopyMem (
 632       &IkePacket->RemotePeerIp,
 633       NTOHLLL (&EndPoint->RemoteAddr.v6),
 634       sizeof (EFI_IPv6_ADDRESS)
 635       );
 636   }
 637   //
 638   // Try to open udp io for output if hasn't.
 639   //
 640   Status = IkeOpenOutputUdp (UdpService, &IkePacket->RemotePeerIp);
 641
 642   if (EFI_ERROR (Status)) {
 643     goto ON_EXIT;
 644   }
 645
 646   IkeHdr = IkePacket->Header;
 647
 648   //
 649   // Determine the IKE exchange instance by the IKE version in IKE header.
 650   //
 651   if (IKE_MAJOR_VERSION (IkeHdr->Version) == 2) {
 652     Exchange = mIkeExchange[IKE_MAJOR_VERSION (IkeHdr->Version) - 1];
 653   } else {
 654     goto ON_EXIT;
 655   }
 656
 657   switch (IkeHdr->ExchangeType) {
 658   case IKE_XCG_TYPE_IDENTITY_PROTECT:
 659   case IKE_XCG_TYPE_SA_INIT:
 660   case IKE_XCG_TYPE_AUTH:
 661     Exchange->HandleSa (UdpService, IkePacket);
 662     break;
 663
 664   case IKE_XCG_TYPE_QM:
 665   case IKE_XCG_TYPE_CREATE_CHILD_SA:
 666     Exchange->HandleChildSa (UdpService, IkePacket);
 667     break;
 668
 669   case IKE_XCG_TYPE_INFO:
 670   case IKE_XCG_TYPE_INFO2:
 671     Exchange->HandleInfo (UdpService, IkePacket);
 672     break;
 673
 674   default:
 675     break;
 676   }
 677
 678 ON_EXIT:
 679   if (IkePacket != NULL) {
 680     IkePacketFree (IkePacket);
 681   }
 682
 683   if (Packet != NULL) {
 684     NetbufFree (Packet);
 685   }
 686
 687   UdpIoRecvDatagram (UdpService->Input, IkeDispatch, UdpService, 0);
 688
 689   return ;
 690 }
 691
 692 /**
 693   Delete all established IKE SAs and related Child SAs.
 694
 695   This function is the subfunction of the IpSecCleanupAllSa(). It first calls
 696   IkeDeleteChildSa() to delete all Child SAs then send out the related
 697   Information packet.
 698
 699   @param[in]  Private           Pointer of the IPSEC_PRIVATE_DATA
 700   @param[in]  IsDisableIpsec    Indicate whether needs to disable IPsec.
 701
 702 **/
 703 VOID
 704 IkeDeleteAllSas (
 705   IN IPSEC_PRIVATE_DATA  *Private,
 706   IN BOOLEAN             IsDisableIpsec
 707   )
 708 {
 709   LIST_ENTRY             *Entry;
 710   LIST_ENTRY             *NextEntry;
 711   IKEV2_SA_SESSION       *Ikev2SaSession;
 712   UINT8                  Value;
 713   EFI_STATUS             Status;
 714   IKE_EXCHANGE_INTERFACE *Exchange;
 715   UINT8                  IkeVersion;
 716
 717   Exchange = NULL;
 718
 719   //
 720   // If the IKEv1 is supported, first deal with the Ikev1Estatblished list.
 721   //
 722
 723   //
 724   // If IKEv2 SAs are under establishing, delete it directly.
 725   //
 726   if (!IsListEmpty (&Private->Ikev2SessionList)) {
 727     NET_LIST_FOR_EACH_SAFE (Entry, NextEntry, &Private->Ikev2SessionList) {
 728       Ikev2SaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);
 729       RemoveEntryList (Entry);
 730       Ikev2SaSessionFree (Ikev2SaSession);
 731     }
 732   }
 733
 734   //
 735   // If there is no existing established IKE SA, set the Ipsec DisableFlag to TRUE
 736   // and turn off the IsIPsecDisabling flag.
 737   //
 738   if (IsListEmpty (&Private->Ikev2EstablishedList) && IsDisableIpsec) {
 739     Value = IPSEC_STATUS_DISABLED;
 740     Status = gRT->SetVariable (
 741                IPSECCONFIG_STATUS_NAME,
 742                &gEfiIpSecConfigProtocolGuid,
 743                EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_NON_VOLATILE,
 744                sizeof (Value),
 745                &Value
 746                );
 747     if (!EFI_ERROR (Status)) {
 748       Private->IpSec.DisabledFlag = TRUE;
 749       Private->IsIPsecDisabling   = FALSE;
 750       return ;
 751     }
 752   }
 753
 754   //
 755   // Delete established IKEv2 SAs.
 756   //
 757   if (!IsListEmpty (&Private->Ikev2EstablishedList)) {
 758     for (Entry = Private->Ikev2EstablishedList.ForwardLink; Entry != &Private->Ikev2EstablishedList;) {
 759       Ikev2SaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);
 760       Entry = Entry->ForwardLink;
 761
 762       Ikev2SaSession->SessionCommon.State = IkeStateSaDeleting;
 763
 764       //
 765       // Call for Information Exchange.
 766       //
 767       IkeVersion = IkeGetVersionFromSession ((UINT8*)Ikev2SaSession);
 768       if (IkeVersion == 2) {
 769         Exchange = mIkeExchange[IkeVersion - 1];
 770         Exchange->NegotiateInfo((UINT8*)Ikev2SaSession, NULL);
 771       }
 772     }
 773   }
 774
 775 }
 776
 777
 778