NetworkPkg/IpSecDxe/IkeService.c

   1 /** @file
   2   Provide IPsec Key Exchange (IKE) service general interfaces.
   3
   4   Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>
   5
   6   This program and the accompanying materials
   7   are licensed and made available under the terms and conditions of the BSD License
   8   which accompanies this distribution.  The full text of the license may be found at
   9   http://opensource.org/licenses/bsd-license.php.
  10
  11   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  12   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  13
  14 **/
  15
  16 #include "IkeService.h"
  17 #include "IpSecConfigImpl.h"
  18 #include "Ikev2/Utility.h"
  19
  20 IKE_EXCHANGE_INTERFACE  *mIkeExchange[] = {
  21   &mIkev1Exchange,
  22   &mIkev2Exchange
  23 };
  24
  25 EFI_UDP4_CONFIG_DATA    mUdp4Conf = {
  26   FALSE,
  27   FALSE,
  28   FALSE,
  29   TRUE,
  30   //
  31   // IO parameters
  32   //
  33   0,
  34   64,
  35   FALSE,
  36   0,
  37   1000000,
  38   FALSE,
  39   {{0,0,0,0}},
  40   {{0,0,0,0}},
  41   IKE_DEFAULT_PORT,
  42   {{0,0,0,0}},
  43   0
  44 };
  45
  46 EFI_UDP6_CONFIG_DATA    mUdp6Conf = {
  47   FALSE,
  48   FALSE,
  49   TRUE,
  50   //
  51   // IO parameters
  52   //
  53   0,
  54   128,
  55   0,
  56   1000000,
  57   //Access Point
  58   {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}},
  59   IKE_DEFAULT_PORT,
  60   {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}},
  61   0
  62 };
  63
  64 /**
  65   Check if the NIC handle is binded to a Udp service.
  66
  67   @param[in]  Private    Pointer of IPSEC_PRIVATE_DATA.
  68   @param[in]  Handle     The Handle of the NIC card.
  69   @param[in]  IpVersion  The version of the IP stack.
  70
  71   @return a pointer of IKE_UDP_SERVICE.
  72
  73 **/
  74 IKE_UDP_SERVICE *
  75 IkeLookupUdp (
  76   IN IPSEC_PRIVATE_DATA     *Private,
  77   IN EFI_HANDLE             Handle,
  78   IN UINT8                  IpVersion
  79   )
  80 {
  81   LIST_ENTRY      *Head;
  82   LIST_ENTRY      *Entry;
  83   LIST_ENTRY      *Next;
  84   IKE_UDP_SERVICE *Udp;
  85
  86   Udp   = NULL;
  87   Head  = (IpVersion == IP_VERSION_4) ? &Private->Udp4List : &Private->Udp6List;
  88
  89   NET_LIST_FOR_EACH_SAFE (Entry, Next, Head) {
  90
  91     Udp = IPSEC_UDP_SERVICE_FROM_LIST (Entry);
  92     //
  93     // Find the right udp service which installed on the appointed NIC handle.
  94     //
  95     if (Handle == Udp->NicHandle) {
  96       break;
  97     } else {
  98       Udp = NULL;
  99     }
 100   }
 101
 102   return Udp;
 103 }
 104
 105 /**
 106   Configure a UDPIO's UDP4 instance.
 107
 108   This fuction is called by the UdpIoCreateIo() to configures a
 109   UDP4 instance.
 110
 111   @param[in] UdpIo         The UDP_IO to be configured.
 112   @param[in] Context       User-defined data when calling UdpIoCreateIo().
 113
 114   @retval EFI_SUCCESS      The configuration succeeded.
 115   @retval Others           The UDP4 instance fails to configure.
 116
 117 **/
 118 EFI_STATUS
 119 EFIAPI
 120 IkeConfigUdp4 (
 121   IN UDP_IO                 *UdpIo,
 122   IN VOID                   *Context
 123   )
 124 {
 125   EFI_UDP4_CONFIG_DATA  Udp4Cfg;
 126   EFI_UDP4_PROTOCOL     *Udp4;
 127
 128   ZeroMem (&Udp4Cfg, sizeof (EFI_UDP4_CONFIG_DATA));
 129
 130   Udp4 = UdpIo->Protocol.Udp4;
 131   CopyMem (
 132     &Udp4Cfg,
 133     &mUdp4Conf,
 134     sizeof (EFI_UDP4_CONFIG_DATA)
 135     );
 136
 137   if (Context != NULL) {
 138     //
 139     // Configure udp4 io with local default address.
 140     //
 141     Udp4Cfg.UseDefaultAddress = TRUE;
 142   }
 143
 144   return Udp4->Configure (Udp4, &Udp4Cfg);
 145 }
 146
 147 /**
 148   Configure a UDPIO's UDP6 instance.
 149
 150   This fuction is called by the UdpIoCreateIo()to configure a
 151   UDP6 instance.
 152
 153   @param[in] UdpIo         The UDP_IO to be configured.
 154   @param[in] Context       User-defined data when calling UdpIoCreateIo().
 155
 156   @retval EFI_SUCCESS      The configuration succeeded.
 157   @retval Others           The configuration fails.
 158
 159 **/
 160 EFI_STATUS
 161 EFIAPI
 162 IkeConfigUdp6 (
 163   IN UDP_IO                 *UdpIo,
 164   IN VOID                   *Context
 165   )
 166 {
 167   EFI_UDP6_PROTOCOL     *Udp6;
 168   EFI_UDP6_CONFIG_DATA  Udp6Cfg;
 169
 170   ZeroMem (&Udp6Cfg, sizeof (EFI_UDP6_CONFIG_DATA));
 171
 172   Udp6 = UdpIo->Protocol.Udp6;
 173   CopyMem (
 174     &Udp6Cfg,
 175     &mUdp6Conf,
 176     sizeof (EFI_UDP6_CONFIG_DATA)
 177     );
 178
 179   if (Context != NULL) {
 180     //
 181     // Configure instance with a destination address to start source address
 182     // selection, and then get the configure data from the mode data to store
 183     // the source address.
 184     //
 185     CopyMem (
 186       &Udp6Cfg.RemoteAddress,
 187       Context,
 188       sizeof (EFI_IPv6_ADDRESS)
 189       );
 190   }
 191
 192   return Udp6->Configure (Udp6, &Udp6Cfg);
 193 }
 194
 195 /**
 196   Open and configure the related output UDPIO for IKE packet sending.
 197
 198   If the UdpService is not configured, this fuction calls UdpIoCreatIo() to
 199   create UDPIO to bind this UdpService for IKE packet sending. If the UdpService
 200   has already been configured, then return.
 201
 202   @param[in] UdpService     The UDP_IO to be configured.
 203   @param[in] RemoteIp       User-defined data when calling UdpIoCreateIo().
 204
 205   @retval EFI_SUCCESS      The configuration is successful.
 206   @retval Others           The configuration fails.
 207
 208 **/
 209 EFI_STATUS
 210 IkeOpenOutputUdp (
 211   IN IKE_UDP_SERVICE           *UdpService,
 212   IN EFI_IP_ADDRESS            *RemoteIp
 213   )
 214 {
 215   EFI_STATUS              Status;
 216   EFI_IP4_CONFIG_PROTOCOL *Ip4Cfg;
 217   EFI_IP4_IPCONFIG_DATA   *Ip4CfgData;
 218   UINTN                   BufSize;
 219   EFI_IP6_MODE_DATA       Ip6ModeData;
 220   EFI_UDP6_PROTOCOL       *Udp6;
 221
 222   Status      = EFI_SUCCESS;
 223   Ip4CfgData  = NULL;
 224   BufSize     = 0;
 225
 226   //
 227   // Check whether the input and output udp io are both configured.
 228   //
 229   if (UdpService->IsConfigured) {
 230     goto ON_EXIT;
 231   }
 232
 233   if (UdpService->IpVersion == UDP_IO_UDP4_VERSION) {
 234     //
 235     // Handle ip4config protocol to get local default address.
 236     //
 237     Status = gBS->HandleProtocol (
 238                     UdpService->NicHandle,
 239                     &gEfiIp4ConfigProtocolGuid,
 240                     (VOID **) &Ip4Cfg
 241                     );
 242
 243     if (EFI_ERROR (Status)) {
 244       goto ON_EXIT;
 245     }
 246
 247     Status = Ip4Cfg->GetData (Ip4Cfg, &BufSize, NULL);
 248
 249     if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {
 250       goto ON_EXIT;
 251     }
 252
 253     Ip4CfgData = AllocateZeroPool (BufSize);
 254
 255     if (Ip4CfgData == NULL) {
 256       Status = EFI_OUT_OF_RESOURCES;
 257       goto ON_EXIT;
 258     }
 259
 260     Status = Ip4Cfg->GetData (Ip4Cfg, &BufSize, Ip4CfgData);
 261     if (EFI_ERROR (Status)) {
 262       goto ON_EXIT;
 263     }
 264
 265     CopyMem (
 266       &UdpService->DefaultAddress.v4,
 267       &Ip4CfgData->StationAddress,
 268       sizeof (EFI_IPv4_ADDRESS)
 269       );
 270
 271     //
 272     // Create udp4 io for output with local default address.
 273     //
 274     UdpService->Output = UdpIoCreateIo (
 275                            UdpService->NicHandle,
 276                            UdpService->ImageHandle,
 277                            IkeConfigUdp4,
 278                            UDP_IO_UDP4_VERSION,
 279                            &UdpService->DefaultAddress
 280                            );
 281
 282     if (UdpService->Output == NULL) {
 283       Status = EFI_OUT_OF_RESOURCES;
 284       goto ON_EXIT;
 285     }
 286
 287   } else {
 288     //
 289     // Create udp6 io for output with remote address.
 290     //
 291     UdpService->Output = UdpIoCreateIo (
 292                            UdpService->NicHandle,
 293                            UdpService->ImageHandle,
 294                            IkeConfigUdp6,
 295                            UDP_IO_UDP6_VERSION,
 296                            RemoteIp
 297                            );
 298
 299     if (UdpService->Output == NULL) {
 300       Status = EFI_OUT_OF_RESOURCES;
 301       goto ON_EXIT;
 302     }
 303     //
 304     // Get ip6 mode data to get the result of source address selection.
 305     //
 306     ZeroMem (&Ip6ModeData, sizeof (EFI_IP6_MODE_DATA));
 307
 308     Udp6    = UdpService->Output->Protocol.Udp6;
 309     Status  = Udp6->GetModeData (Udp6, NULL, &Ip6ModeData, NULL, NULL);
 310
 311     if (EFI_ERROR (Status)) {
 312       UdpIoFreeIo (UdpService->Output);
 313       goto ON_EXIT;
 314     }
 315     //
 316     // Reconfigure udp6 io without remote address.
 317     //
 318     Udp6->Configure (Udp6, NULL);
 319     Status = IkeConfigUdp6 (UdpService->Output, NULL);
 320
 321     //
 322     // Record the selected source address for ipsec process later.
 323     //
 324     CopyMem (
 325       &UdpService->DefaultAddress.v6,
 326       &Ip6ModeData.ConfigData.StationAddress,
 327       sizeof (EFI_IPv6_ADDRESS)
 328       );
 329   }
 330
 331   UdpService->IsConfigured = TRUE;
 332
 333 ON_EXIT:
 334   if (Ip4CfgData != NULL) {
 335     FreePool (Ip4CfgData);
 336   }
 337
 338   return Status;
 339 }
 340
 341 /**
 342   Open and configure a UDPIO of Udp4 for IKE packet receiving.
 343
 344   This function is called at the IPsecDriverBinding start. IPsec create a UDP4 and
 345   UDP4 IO for each NIC handle.
 346
 347   @param[in] Private        Point to IPSEC_PRIVATE_DATA
 348   @param[in] Controller     Handler for NIC card.
 349
 350   @retval EFI_SUCCESS             The Operation is successful.
 351   @retval EFI_OUT_OF_RESOURCE     The required system resource can't be allocated.
 352
 353 **/
 354 EFI_STATUS
 355 IkeOpenInputUdp4 (
 356   IN IPSEC_PRIVATE_DATA           *Private,
 357   IN EFI_HANDLE                   Controller
 358   )
 359 {
 360   IKE_UDP_SERVICE *Udp4Srv;
 361
 362   //
 363   // Check whether udp4 io of the controller has already been opened.
 364   //
 365   Udp4Srv = IkeLookupUdp (Private, Controller, IP_VERSION_4);
 366
 367   if (Udp4Srv != NULL) {
 368     return EFI_ALREADY_STARTED;
 369   }
 370
 371   Udp4Srv = AllocateZeroPool (sizeof (IKE_UDP_SERVICE));
 372
 373   if (Udp4Srv == NULL) {
 374     return EFI_OUT_OF_RESOURCES;
 375   }
 376   //
 377   // Create udp4 io for iutput.
 378   //
 379   Udp4Srv->Input = UdpIoCreateIo (
 380                      Controller,
 381                      Private->ImageHandle,
 382                      IkeConfigUdp4,
 383                      UDP_IO_UDP4_VERSION,
 384                      NULL
 385                      );
 386
 387   if (Udp4Srv->Input == NULL) {
 388     FreePool (Udp4Srv);
 389     return EFI_OUT_OF_RESOURCES;
 390   }
 391
 392   Udp4Srv->NicHandle    = Controller;
 393   Udp4Srv->ImageHandle  = Private->ImageHandle;
 394   Udp4Srv->ListHead     = &(Private->Udp4List);
 395   Udp4Srv->IpVersion    = UDP_IO_UDP4_VERSION;
 396   Udp4Srv->IsConfigured = FALSE;
 397
 398   ZeroMem (&Udp4Srv->DefaultAddress, sizeof (EFI_IP_ADDRESS));
 399
 400   //
 401   // Insert the udp4 io into the list and increase the count.
 402   //
 403   InsertTailList (&Private->Udp4List, &Udp4Srv->List);
 404
 405   Private->Udp4Num++;
 406
 407   UdpIoRecvDatagram (Udp4Srv->Input, IkeDispatch, Udp4Srv, 0);
 408
 409   return EFI_SUCCESS;
 410 }
 411
 412 /**
 413   Open and configure a UDPIO of Udp6 for IKE packet receiving.
 414
 415   This function is called at the IPsecDriverBinding start. IPsec create a UDP6 and UDP6
 416   IO for each NIC handle.
 417
 418   @param[in] Private        Point to IPSEC_PRIVATE_DATA
 419   @param[in] Controller     Handler for NIC card.
 420
 421   @retval EFI_SUCCESS             The Operation is successful.
 422   @retval EFI_OUT_OF_RESOURCE     The required system resource can't be allocated.
 423
 424 **/
 425 EFI_STATUS
 426 IkeOpenInputUdp6 (
 427   IN IPSEC_PRIVATE_DATA           *Private,
 428   IN EFI_HANDLE                   Controller
 429   )
 430 {
 431   IKE_UDP_SERVICE *Udp6Srv;
 432
 433   Udp6Srv = IkeLookupUdp (Private, Controller, IP_VERSION_6);
 434
 435   if (Udp6Srv != NULL) {
 436     return EFI_ALREADY_STARTED;
 437   }
 438
 439   Udp6Srv = AllocateZeroPool (sizeof (IKE_UDP_SERVICE));
 440
 441   if (Udp6Srv == NULL) {
 442     return EFI_OUT_OF_RESOURCES;
 443   }
 444   //
 445   // Create udp6 io for input.
 446   //
 447   Udp6Srv->Input = UdpIoCreateIo (
 448                      Controller,
 449                      Private->ImageHandle,
 450                      IkeConfigUdp6,
 451                      UDP_IO_UDP6_VERSION,
 452                      NULL
 453                      );
 454
 455   if (Udp6Srv->Input == NULL) {
 456     FreePool (Udp6Srv);
 457     return EFI_OUT_OF_RESOURCES;
 458   }
 459
 460   Udp6Srv->NicHandle    = Controller;
 461   Udp6Srv->ImageHandle  = Private->ImageHandle;
 462   Udp6Srv->ListHead     = &(Private->Udp6List);
 463   Udp6Srv->IpVersion    = UDP_IO_UDP6_VERSION;
 464   Udp6Srv->IsConfigured = FALSE;
 465
 466   ZeroMem (&Udp6Srv->DefaultAddress, sizeof (EFI_IP_ADDRESS));
 467
 468   //
 469   // Insert the udp6 io into the list and increase the count.
 470   //
 471   InsertTailList (&Private->Udp6List, &Udp6Srv->List);
 472
 473   Private->Udp6Num++;
 474
 475   UdpIoRecvDatagram (Udp6Srv->Input, IkeDispatch, Udp6Srv, 0);
 476
 477   return EFI_SUCCESS;
 478 }
 479
 480 /**
 481   The general interface of starting IPsec Key Exchange.
 482
 483   This function is called when a IKE negotiation to start getting a Key.
 484
 485   @param[in] UdpService   Point to IKE_UDP_SERVICE which will be used for
 486                           IKE packet sending.
 487   @param[in] SpdEntry     Point to the SPD entry related to the IKE negotiation.
 488   @param[in] RemoteIp     Point to EFI_IP_ADDRESS related to the IKE negotiation.
 489
 490   @retval EFI_SUCCESS            The Operation is successful.
 491   @retval EFI_ACCESS_DENIED      No related PAD entry was found.
 492   @retval EFI_INVALID_PARAMETER  The IKE version is not supported.
 493
 494 **/
 495 EFI_STATUS
 496 IkeNegotiate (
 497   IN IKE_UDP_SERVICE       *UdpService,
 498   IN IPSEC_SPD_ENTRY       *SpdEntry,
 499   IN EFI_IP_ADDRESS        *RemoteIp
 500   )
 501 {
 502   EFI_STATUS               Status;
 503   UINT8                    *IkeSaSession;
 504   IKE_EXCHANGE_INTERFACE   *Exchange;
 505   IPSEC_PRIVATE_DATA       *Private;
 506   IPSEC_PAD_ENTRY          *PadEntry;
 507   UINT8                    IkeVersion;
 508
 509   Private = (UdpService->IpVersion == IP_VERSION_4) ?
 510              IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :
 511              IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);
 512
 513   //
 514   // Try to open udp io for output if it hasn't.
 515   //
 516   Status = IkeOpenOutputUdp (UdpService, RemoteIp);
 517   if (EFI_ERROR (Status)) {
 518     return Status;
 519   }
 520   //
 521   // Try to find the IKE SA session in the IKEv1 and IKEv2 established SA session list.
 522   //
 523   IkeSaSession = (UINT8 *) Ikev2SaSessionLookup (&Private->Ikev2EstablishedList, RemoteIp);
 524
 525
 526   if (IkeSaSession == NULL) {
 527     //
 528     // Find the pad entry by the remote ip address.
 529     //
 530     PadEntry = IpSecLookupPadEntry (UdpService->IpVersion, RemoteIp);
 531     if (PadEntry == NULL) {
 532       return EFI_ACCESS_DENIED;
 533     }
 534     //
 535     // Determine the IKE exchange instance by the auth protocol in pad entry.
 536     //
 537     ASSERT (PadEntry->Data->AuthProtocol < EfiIPsecAuthProtocolMaximum);
 538     if (PadEntry->Data->AuthProtocol == EfiIPsecAuthProtocolIKEv1) {
 539       return EFI_INVALID_PARAMETER;
 540     }
 541     Exchange = mIkeExchange[PadEntry->Data->AuthProtocol];
 542     //
 543     // Start the main mode stage to negotiate IKE SA.
 544     //
 545     Status = Exchange->NegotiateSa (UdpService, SpdEntry, PadEntry, RemoteIp);
 546   } else {
 547     //
 548     // Determine the IKE exchange instance by the IKE version in IKE SA session.
 549     //
 550     IkeVersion = IkeGetVersionFromSession (IkeSaSession);
 551     if (IkeVersion != 2) {
 552       return EFI_INVALID_PARAMETER;
 553     }
 554
 555     Exchange = mIkeExchange[IkeVersion - 1];
 556     //
 557     // Start the quick mode stage to negotiate child SA.
 558     //
 559     Status = Exchange->NegotiateChildSa (IkeSaSession, SpdEntry, NULL);
 560   }
 561
 562   return Status;
 563 }
 564
 565 /**
 566   The generic interface when receive a IKE packet.
 567
 568   This function is called when UDP IO receives a IKE packet.
 569
 570   @param[in] Packet       Point to received IKE packet.
 571   @param[in] EndPoint     Point to UDP_END_POINT which contains the information of
 572                           Remote IP and Port.
 573   @param[in] IoStatus     The Status of Recieve Token.
 574   @param[in] Context      Point to data passed from the caller.
 575
 576 **/
 577 VOID
 578 EFIAPI
 579 IkeDispatch (
 580   IN NET_BUF                        *Packet,
 581   IN UDP_END_POINT                  *EndPoint,
 582   IN EFI_STATUS                     IoStatus,
 583   IN VOID                           *Context
 584   )
 585 {
 586   IPSEC_PRIVATE_DATA                *Private;
 587   IKE_PACKET                        *IkePacket;
 588   IKE_HEADER                        *IkeHdr;
 589   IKE_UDP_SERVICE                   *UdpService;
 590   IKE_EXCHANGE_INTERFACE            *Exchange;
 591   EFI_STATUS                        Status;
 592
 593   UdpService = (IKE_UDP_SERVICE *) Context;
 594   IkePacket  = NULL;
 595   Private    = (UdpService->IpVersion == IP_VERSION_4) ?
 596                IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :
 597                IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);
 598
 599   if (EFI_ERROR (IoStatus)) {
 600     goto ON_EXIT;
 601   }
 602   //
 603   // Check whether the ipsec is enabled or not.
 604   //
 605   if (Private->IpSec.DisabledFlag == TRUE) {
 606     goto ON_EXIT;
 607   }
 608
 609   if (EndPoint->RemotePort != IKE_DEFAULT_PORT) {
 610     goto ON_EXIT;
 611   }
 612
 613   //
 614   // Build IKE packet from the received netbuf.
 615   //
 616   IkePacket = IkePacketFromNetbuf (Packet);
 617
 618   if (IkePacket == NULL) {
 619     goto ON_EXIT;
 620   }
 621   //
 622   // Get the remote address from the IKE packet.
 623   //
 624   if (UdpService->IpVersion == IP_VERSION_4) {
 625     *(UINT32 *) IkePacket->RemotePeerIp.Addr = HTONL ((*(UINT32 *) EndPoint->RemoteAddr.Addr));
 626   } else {
 627     CopyMem (
 628       &IkePacket->RemotePeerIp,
 629       NTOHLLL (&EndPoint->RemoteAddr.v6),
 630       sizeof (EFI_IPv6_ADDRESS)
 631       );
 632   }
 633   //
 634   // Try to open udp io for output if hasn't.
 635   //
 636   Status = IkeOpenOutputUdp (UdpService, &IkePacket->RemotePeerIp);
 637
 638   if (EFI_ERROR (Status)) {
 639     goto ON_EXIT;
 640   }
 641
 642   IkeHdr = IkePacket->Header;
 643
 644   //
 645   // Determine the IKE exchange instance by the IKE version in IKE header.
 646   //
 647   if (IKE_MAJOR_VERSION (IkeHdr->Version) == 2) {
 648     Exchange = mIkeExchange[IKE_MAJOR_VERSION (IkeHdr->Version) - 1];
 649   } else {
 650     goto ON_EXIT;
 651   }
 652
 653   switch (IkeHdr->ExchangeType) {
 654   case IKE_XCG_TYPE_IDENTITY_PROTECT:
 655   case IKE_XCG_TYPE_SA_INIT:
 656   case IKE_XCG_TYPE_AUTH:
 657     Exchange->HandleSa (UdpService, IkePacket);
 658     break;
 659
 660   case IKE_XCG_TYPE_QM:
 661   case IKE_XCG_TYPE_CREATE_CHILD_SA:
 662     Exchange->HandleChildSa (UdpService, IkePacket);
 663     break;
 664
 665   case IKE_XCG_TYPE_INFO:
 666   case IKE_XCG_TYPE_INFO2:
 667     Exchange->HandleInfo (UdpService, IkePacket);
 668     break;
 669
 670   default:
 671     break;
 672   }
 673
 674 ON_EXIT:
 675   if (IkePacket != NULL) {
 676     IkePacketFree (IkePacket);
 677   }
 678
 679   if (Packet != NULL) {
 680     NetbufFree (Packet);
 681   }
 682
 683   UdpIoRecvDatagram (UdpService->Input, IkeDispatch, UdpService, 0);
 684
 685   return ;
 686 }
 687
 688 /**
 689   Delete all established IKE SAs and related Child SAs.
 690
 691   This function is the subfunction of the IpSecCleanupAllSa(). It first calls
 692   IkeDeleteChildSa() to delete all Child SAs then send out the related
 693   Information packet.
 694
 695   @param[in]  Private           Pointer of the IPSEC_PRIVATE_DATA
 696   @param[in]  IsDisableIpsec    Indicate whether needs to disable IPsec.
 697
 698 **/
 699 VOID
 700 IkeDeleteAllSas (
 701   IN IPSEC_PRIVATE_DATA  *Private,
 702   IN BOOLEAN             IsDisableIpsec
 703   )
 704 {
 705   LIST_ENTRY             *Entry;
 706   LIST_ENTRY             *NextEntry;
 707   IKEV2_SA_SESSION       *Ikev2SaSession;
 708   UINT8                  Value;
 709   EFI_STATUS             Status;
 710   IKE_EXCHANGE_INTERFACE *Exchange;
 711   UINT8                  IkeVersion;
 712
 713   Exchange = NULL;
 714
 715   //
 716   // If the IKEv1 is supported, first deal with the Ikev1Estatblished list.
 717   //
 718
 719   //
 720   // If IKEv2 SAs are under establishing, delete it directly.
 721   //
 722   if (!IsListEmpty (&Private->Ikev2SessionList)) {
 723     NET_LIST_FOR_EACH_SAFE (Entry, NextEntry, &Private->Ikev2SessionList) {
 724       Ikev2SaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);
 725       RemoveEntryList (Entry);
 726       Ikev2SaSessionFree (Ikev2SaSession);
 727     }
 728   }
 729
 730   //
 731   // If there is no existing established IKE SA, set the Ipsec DisableFlag to TRUE
 732   // and turn off the IsIPsecDisabling flag.
 733   //
 734   if (IsListEmpty (&Private->Ikev2EstablishedList) && IsDisableIpsec) {
 735     Value = IPSEC_STATUS_DISABLED;
 736     Status = gRT->SetVariable (
 737                IPSECCONFIG_STATUS_NAME,
 738                &gEfiIpSecConfigProtocolGuid,
 739                EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_NON_VOLATILE,
 740                sizeof (Value),
 741                &Value
 742                );
 743     if (!EFI_ERROR (Status)) {
 744       Private->IpSec.DisabledFlag = TRUE;
 745       Private->IsIPsecDisabling   = FALSE;
 746       return ;
 747     }
 748   }
 749
 750   //
 751   // Delete established IKEv2 SAs.
 752   //
 753   if (!IsListEmpty (&Private->Ikev2EstablishedList)) {
 754     for (Entry = Private->Ikev2EstablishedList.ForwardLink; Entry != &Private->Ikev2EstablishedList;) {
 755       Ikev2SaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);
 756       Entry = Entry->ForwardLink;
 757
 758       Ikev2SaSession->SessionCommon.State = IkeStateSaDeleting;
 759
 760       //
 761       // Call for Information Exchange.
 762       //
 763       IkeVersion = IkeGetVersionFromSession ((UINT8*)Ikev2SaSession);
 764       if (IkeVersion == 2) {
 765         Exchange = mIkeExchange[IkeVersion - 1];
 766         Exchange->NegotiateInfo((UINT8*)Ikev2SaSession, NULL);
 767       }
 768     }
 769   }
 770
 771 }
 772
 773
 774