2 Provide IPsec Key Exchange (IKE) service general interfaces.
4 Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>
6 This program and the accompanying materials
7 are licensed and made available under the terms and conditions of the BSD License
8 which accompanies this distribution. The full text of the license may be found at
9 http://opensource.org/licenses/bsd-license.php.
11 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
12 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
16 #include "IkeService.h"
17 #include "IpSecConfigImpl.h"
18 #include "Ikev2/Utility.h"
20 IKE_EXCHANGE_INTERFACE
*mIkeExchange
[] = {
25 EFI_UDP4_CONFIG_DATA mUdp4Conf
= {
46 EFI_UDP6_CONFIG_DATA mUdp6Conf
= {
58 {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}},
60 {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}},
65 Check if the NIC handle is binded to a Udp service.
67 @param[in] Private Pointer of IPSEC_PRIVATE_DATA.
68 @param[in] Handle The Handle of the NIC card.
69 @param[in] IpVersion The version of the IP stack.
71 @return a pointer of IKE_UDP_SERVICE.
76 IN IPSEC_PRIVATE_DATA
*Private
,
87 Head
= (IpVersion
== IP_VERSION_4
) ? &Private
->Udp4List
: &Private
->Udp6List
;
89 NET_LIST_FOR_EACH_SAFE (Entry
, Next
, Head
) {
91 Udp
= IPSEC_UDP_SERVICE_FROM_LIST (Entry
);
93 // Find the right udp service which installed on the appointed NIC handle.
95 if (Handle
== Udp
->NicHandle
) {
106 Configure a UDPIO's UDP4 instance.
108 This fuction is called by the UdpIoCreateIo() to configures a
111 @param[in] UdpIo The UDP_IO to be configured.
112 @param[in] Context User-defined data when calling UdpIoCreateIo().
114 @retval EFI_SUCCESS The configuration succeeded.
115 @retval Others The UDP4 instance fails to configure.
125 EFI_UDP4_CONFIG_DATA Udp4Cfg
;
126 EFI_UDP4_PROTOCOL
*Udp4
;
128 ZeroMem (&Udp4Cfg
, sizeof (EFI_UDP4_CONFIG_DATA
));
130 Udp4
= UdpIo
->Protocol
.Udp4
;
134 sizeof (EFI_UDP4_CONFIG_DATA
)
137 if (Context
!= NULL
) {
139 // Configure udp4 io with local default address.
141 Udp4Cfg
.UseDefaultAddress
= TRUE
;
144 return Udp4
->Configure (Udp4
, &Udp4Cfg
);
148 Configure a UDPIO's UDP6 instance.
150 This fuction is called by the UdpIoCreateIo()to configure a
153 @param[in] UdpIo The UDP_IO to be configured.
154 @param[in] Context User-defined data when calling UdpIoCreateIo().
156 @retval EFI_SUCCESS The configuration succeeded.
157 @retval Others The configuration fails.
167 EFI_UDP6_PROTOCOL
*Udp6
;
168 EFI_UDP6_CONFIG_DATA Udp6Cfg
;
170 ZeroMem (&Udp6Cfg
, sizeof (EFI_UDP6_CONFIG_DATA
));
172 Udp6
= UdpIo
->Protocol
.Udp6
;
176 sizeof (EFI_UDP6_CONFIG_DATA
)
179 if (Context
!= NULL
) {
181 // Configure instance with a destination address to start source address
182 // selection, and then get the configure data from the mode data to store
183 // the source address.
186 &Udp6Cfg
.RemoteAddress
,
188 sizeof (EFI_IPv6_ADDRESS
)
192 return Udp6
->Configure (Udp6
, &Udp6Cfg
);
196 Open and configure the related output UDPIO for IKE packet sending.
198 If the UdpService is not configured, this fuction calls UdpIoCreatIo() to
199 create UDPIO to bind this UdpService for IKE packet sending. If the UdpService
200 has already been configured, then return.
202 @param[in] UdpService The UDP_IO to be configured.
203 @param[in] RemoteIp User-defined data when calling UdpIoCreateIo().
205 @retval EFI_SUCCESS The configuration is successful.
206 @retval Others The configuration fails.
211 IN IKE_UDP_SERVICE
*UdpService
,
212 IN EFI_IP_ADDRESS
*RemoteIp
216 EFI_IP4_CONFIG2_PROTOCOL
*Ip4Cfg2
;
217 EFI_IP4_CONFIG2_INTERFACE_INFO
*IfInfo
;
219 EFI_IP6_MODE_DATA Ip6ModeData
;
220 EFI_UDP6_PROTOCOL
*Udp6
;
222 Status
= EFI_SUCCESS
;
227 // Check whether the input and output udp io are both configured.
229 if (UdpService
->IsConfigured
) {
233 if (UdpService
->IpVersion
== UDP_IO_UDP4_VERSION
) {
235 // Handle ip4config protocol to get local default address.
237 Status
= gBS
->HandleProtocol (
238 UdpService
->NicHandle
,
239 &gEfiIp4Config2ProtocolGuid
,
243 if (EFI_ERROR (Status
)) {
248 // Get the interface information size.
250 Status
= Ip4Cfg2
->GetData (
252 Ip4Config2DataTypeInterfaceInfo
,
257 if (EFI_ERROR (Status
) && Status
!= EFI_BUFFER_TOO_SMALL
) {
261 IfInfo
= AllocateZeroPool (BufSize
);
263 if (IfInfo
== NULL
) {
264 Status
= EFI_OUT_OF_RESOURCES
;
269 // Get the interface info.
271 Status
= Ip4Cfg2
->GetData (
273 Ip4Config2DataTypeInterfaceInfo
,
278 if (EFI_ERROR (Status
)) {
283 &UdpService
->DefaultAddress
.v4
,
284 &IfInfo
->StationAddress
,
285 sizeof (EFI_IPv4_ADDRESS
)
289 // Create udp4 io for output with local default address.
291 UdpService
->Output
= UdpIoCreateIo (
292 UdpService
->NicHandle
,
293 UdpService
->ImageHandle
,
296 &UdpService
->DefaultAddress
299 if (UdpService
->Output
== NULL
) {
300 Status
= EFI_OUT_OF_RESOURCES
;
306 // Create udp6 io for output with remote address.
308 UdpService
->Output
= UdpIoCreateIo (
309 UdpService
->NicHandle
,
310 UdpService
->ImageHandle
,
316 if (UdpService
->Output
== NULL
) {
317 Status
= EFI_OUT_OF_RESOURCES
;
321 // Get ip6 mode data to get the result of source address selection.
323 ZeroMem (&Ip6ModeData
, sizeof (EFI_IP6_MODE_DATA
));
325 Udp6
= UdpService
->Output
->Protocol
.Udp6
;
326 Status
= Udp6
->GetModeData (Udp6
, NULL
, &Ip6ModeData
, NULL
, NULL
);
328 if (EFI_ERROR (Status
)) {
329 UdpIoFreeIo (UdpService
->Output
);
333 // Reconfigure udp6 io without remote address.
335 Udp6
->Configure (Udp6
, NULL
);
336 Status
= IkeConfigUdp6 (UdpService
->Output
, NULL
);
339 // Record the selected source address for ipsec process later.
342 &UdpService
->DefaultAddress
.v6
,
343 &Ip6ModeData
.ConfigData
.StationAddress
,
344 sizeof (EFI_IPv6_ADDRESS
)
348 UdpService
->IsConfigured
= TRUE
;
351 if (IfInfo
!= NULL
) {
359 Open and configure a UDPIO of Udp4 for IKE packet receiving.
361 This function is called at the IPsecDriverBinding start. IPsec create a UDP4 and
362 UDP4 IO for each NIC handle.
364 @param[in] Private Point to IPSEC_PRIVATE_DATA
365 @param[in] Controller Handler for NIC card.
366 @param[in] ImageHandle The handle that contains the EFI_DRIVER_BINDING_PROTOCOL instance.
368 @retval EFI_SUCCESS The Operation is successful.
369 @retval EFI_OUT_OF_RESOURCE The required system resource can't be allocated.
374 IN IPSEC_PRIVATE_DATA
*Private
,
375 IN EFI_HANDLE Controller
,
376 IN EFI_HANDLE ImageHandle
379 IKE_UDP_SERVICE
*Udp4Srv
;
382 // Check whether udp4 io of the controller has already been opened.
384 Udp4Srv
= IkeLookupUdp (Private
, Controller
, IP_VERSION_4
);
386 if (Udp4Srv
!= NULL
) {
387 return EFI_ALREADY_STARTED
;
390 Udp4Srv
= AllocateZeroPool (sizeof (IKE_UDP_SERVICE
));
392 if (Udp4Srv
== NULL
) {
393 return EFI_OUT_OF_RESOURCES
;
396 // Create udp4 io for iutput.
398 Udp4Srv
->Input
= UdpIoCreateIo (
406 if (Udp4Srv
->Input
== NULL
) {
408 return EFI_OUT_OF_RESOURCES
;
411 Udp4Srv
->NicHandle
= Controller
;
412 Udp4Srv
->ImageHandle
= ImageHandle
;
413 Udp4Srv
->ListHead
= &(Private
->Udp4List
);
414 Udp4Srv
->IpVersion
= UDP_IO_UDP4_VERSION
;
415 Udp4Srv
->IsConfigured
= FALSE
;
417 ZeroMem (&Udp4Srv
->DefaultAddress
, sizeof (EFI_IP_ADDRESS
));
420 // Insert the udp4 io into the list and increase the count.
422 InsertTailList (&Private
->Udp4List
, &Udp4Srv
->List
);
426 UdpIoRecvDatagram (Udp4Srv
->Input
, IkeDispatch
, Udp4Srv
, 0);
432 Open and configure a UDPIO of Udp6 for IKE packet receiving.
434 This function is called at the IPsecDriverBinding start. IPsec create a UDP6 and UDP6
435 IO for each NIC handle.
437 @param[in] Private Point to IPSEC_PRIVATE_DATA
438 @param[in] Controller Handler for NIC card.
439 @param[in] ImageHandle The handle that contains the EFI_DRIVER_BINDING_PROTOCOL instance.
441 @retval EFI_SUCCESS The Operation is successful.
442 @retval EFI_OUT_OF_RESOURCE The required system resource can't be allocated.
447 IN IPSEC_PRIVATE_DATA
*Private
,
448 IN EFI_HANDLE Controller
,
449 IN EFI_HANDLE ImageHandle
452 IKE_UDP_SERVICE
*Udp6Srv
;
454 Udp6Srv
= IkeLookupUdp (Private
, Controller
, IP_VERSION_6
);
456 if (Udp6Srv
!= NULL
) {
457 return EFI_ALREADY_STARTED
;
460 Udp6Srv
= AllocateZeroPool (sizeof (IKE_UDP_SERVICE
));
462 if (Udp6Srv
== NULL
) {
463 return EFI_OUT_OF_RESOURCES
;
466 // Create udp6 io for input.
468 Udp6Srv
->Input
= UdpIoCreateIo (
476 if (Udp6Srv
->Input
== NULL
) {
478 return EFI_OUT_OF_RESOURCES
;
481 Udp6Srv
->NicHandle
= Controller
;
482 Udp6Srv
->ImageHandle
= ImageHandle
;
483 Udp6Srv
->ListHead
= &(Private
->Udp6List
);
484 Udp6Srv
->IpVersion
= UDP_IO_UDP6_VERSION
;
485 Udp6Srv
->IsConfigured
= FALSE
;
487 ZeroMem (&Udp6Srv
->DefaultAddress
, sizeof (EFI_IP_ADDRESS
));
490 // Insert the udp6 io into the list and increase the count.
492 InsertTailList (&Private
->Udp6List
, &Udp6Srv
->List
);
496 UdpIoRecvDatagram (Udp6Srv
->Input
, IkeDispatch
, Udp6Srv
, 0);
502 The general interface of starting IPsec Key Exchange.
504 This function is called when a IKE negotiation to start getting a Key.
506 @param[in] UdpService Point to IKE_UDP_SERVICE which will be used for
508 @param[in] SpdEntry Point to the SPD entry related to the IKE negotiation.
509 @param[in] RemoteIp Point to EFI_IP_ADDRESS related to the IKE negotiation.
511 @retval EFI_SUCCESS The Operation is successful.
512 @retval EFI_ACCESS_DENIED No related PAD entry was found.
513 @retval EFI_INVALID_PARAMETER The IKE version is not supported.
518 IN IKE_UDP_SERVICE
*UdpService
,
519 IN IPSEC_SPD_ENTRY
*SpdEntry
,
520 IN EFI_IP_ADDRESS
*RemoteIp
525 IKE_EXCHANGE_INTERFACE
*Exchange
;
526 IPSEC_PRIVATE_DATA
*Private
;
527 IPSEC_PAD_ENTRY
*PadEntry
;
530 Private
= (UdpService
->IpVersion
== IP_VERSION_4
) ?
531 IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService
->ListHead
) :
532 IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService
->ListHead
);
535 // Try to open udp io for output if it hasn't.
537 Status
= IkeOpenOutputUdp (UdpService
, RemoteIp
);
538 if (EFI_ERROR (Status
)) {
542 // Try to find the IKE SA session in the IKEv1 and IKEv2 established SA session list.
544 IkeSaSession
= (UINT8
*) Ikev2SaSessionLookup (&Private
->Ikev2EstablishedList
, RemoteIp
);
547 if (IkeSaSession
== NULL
) {
549 // Find the pad entry by the remote ip address.
551 PadEntry
= IpSecLookupPadEntry (UdpService
->IpVersion
, RemoteIp
);
552 if (PadEntry
== NULL
) {
553 return EFI_ACCESS_DENIED
;
556 // Determine the IKE exchange instance by the auth protocol in pad entry.
558 ASSERT (PadEntry
->Data
->AuthProtocol
< EfiIPsecAuthProtocolMaximum
);
559 if (PadEntry
->Data
->AuthProtocol
== EfiIPsecAuthProtocolIKEv1
) {
560 return EFI_INVALID_PARAMETER
;
562 Exchange
= mIkeExchange
[PadEntry
->Data
->AuthProtocol
];
564 // Start the main mode stage to negotiate IKE SA.
566 Status
= Exchange
->NegotiateSa (UdpService
, SpdEntry
, PadEntry
, RemoteIp
);
569 // Determine the IKE exchange instance by the IKE version in IKE SA session.
571 IkeVersion
= IkeGetVersionFromSession (IkeSaSession
);
572 if (IkeVersion
!= 2) {
573 return EFI_INVALID_PARAMETER
;
576 Exchange
= mIkeExchange
[IkeVersion
- 1];
578 // Start the quick mode stage to negotiate child SA.
580 Status
= Exchange
->NegotiateChildSa (IkeSaSession
, SpdEntry
, NULL
);
587 The generic interface when receive a IKE packet.
589 This function is called when UDP IO receives a IKE packet.
591 @param[in] Packet Point to received IKE packet.
592 @param[in] EndPoint Point to UDP_END_POINT which contains the information of
594 @param[in] IoStatus The Status of Recieve Token.
595 @param[in] Context Point to data passed from the caller.
602 IN UDP_END_POINT
*EndPoint
,
603 IN EFI_STATUS IoStatus
,
607 IPSEC_PRIVATE_DATA
*Private
;
608 IKE_PACKET
*IkePacket
;
610 IKE_UDP_SERVICE
*UdpService
;
611 IKE_EXCHANGE_INTERFACE
*Exchange
;
614 UdpService
= (IKE_UDP_SERVICE
*) Context
;
616 Private
= (UdpService
->IpVersion
== IP_VERSION_4
) ?
617 IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService
->ListHead
) :
618 IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService
->ListHead
);
620 if (EFI_ERROR (IoStatus
)) {
624 // Check whether the ipsec is enabled or not.
626 if (Private
->IpSec
.DisabledFlag
== TRUE
) {
630 if (EndPoint
->RemotePort
!= IKE_DEFAULT_PORT
) {
635 // Build IKE packet from the received netbuf.
637 IkePacket
= IkePacketFromNetbuf (Packet
);
639 if (IkePacket
== NULL
) {
643 // Get the remote address from the IKE packet.
645 if (UdpService
->IpVersion
== IP_VERSION_4
) {
646 *(UINT32
*) IkePacket
->RemotePeerIp
.Addr
= HTONL ((*(UINT32
*) EndPoint
->RemoteAddr
.Addr
));
649 &IkePacket
->RemotePeerIp
,
650 NTOHLLL (&EndPoint
->RemoteAddr
.v6
),
651 sizeof (EFI_IPv6_ADDRESS
)
655 // Try to open udp io for output if hasn't.
657 Status
= IkeOpenOutputUdp (UdpService
, &IkePacket
->RemotePeerIp
);
659 if (EFI_ERROR (Status
)) {
663 IkeHdr
= IkePacket
->Header
;
666 // Determine the IKE exchange instance by the IKE version in IKE header.
668 if (IKE_MAJOR_VERSION (IkeHdr
->Version
) == 2) {
669 Exchange
= mIkeExchange
[IKE_MAJOR_VERSION (IkeHdr
->Version
) - 1];
674 switch (IkeHdr
->ExchangeType
) {
675 case IKE_XCG_TYPE_IDENTITY_PROTECT
:
676 case IKE_XCG_TYPE_SA_INIT
:
677 case IKE_XCG_TYPE_AUTH
:
678 Exchange
->HandleSa (UdpService
, IkePacket
);
681 case IKE_XCG_TYPE_QM
:
682 case IKE_XCG_TYPE_CREATE_CHILD_SA
:
683 Exchange
->HandleChildSa (UdpService
, IkePacket
);
686 case IKE_XCG_TYPE_INFO
:
687 case IKE_XCG_TYPE_INFO2
:
688 Exchange
->HandleInfo (UdpService
, IkePacket
);
696 if (IkePacket
!= NULL
) {
697 IkePacketFree (IkePacket
);
700 if (Packet
!= NULL
) {
704 UdpIoRecvDatagram (UdpService
->Input
, IkeDispatch
, UdpService
, 0);
710 Delete all established IKE SAs and related Child SAs.
712 This function is the subfunction of the IpSecCleanupAllSa(). It first calls
713 IkeDeleteChildSa() to delete all Child SAs then send out the related
716 @param[in] Private Pointer of the IPSEC_PRIVATE_DATA
717 @param[in] IsDisableIpsec Indicate whether needs to disable IPsec.
722 IN IPSEC_PRIVATE_DATA
*Private
,
723 IN BOOLEAN IsDisableIpsec
727 LIST_ENTRY
*NextEntry
;
728 IKEV2_SA_SESSION
*Ikev2SaSession
;
731 IKE_EXCHANGE_INTERFACE
*Exchange
;
737 // If the IKEv1 is supported, first deal with the Ikev1Estatblished list.
741 // If IKEv2 SAs are under establishing, delete it directly.
743 if (!IsListEmpty (&Private
->Ikev2SessionList
)) {
744 NET_LIST_FOR_EACH_SAFE (Entry
, NextEntry
, &Private
->Ikev2SessionList
) {
745 Ikev2SaSession
= IKEV2_SA_SESSION_BY_SESSION (Entry
);
746 RemoveEntryList (Entry
);
747 Ikev2SaSessionFree (Ikev2SaSession
);
752 // If there is no existing established IKE SA, set the Ipsec DisableFlag to TRUE
753 // and turn off the IsIPsecDisabling flag.
755 if (IsListEmpty (&Private
->Ikev2EstablishedList
) && IsDisableIpsec
) {
756 Value
= IPSEC_STATUS_DISABLED
;
757 Status
= gRT
->SetVariable (
758 IPSECCONFIG_STATUS_NAME
,
759 &gEfiIpSecConfigProtocolGuid
,
760 EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_NON_VOLATILE
,
764 if (!EFI_ERROR (Status
)) {
765 Private
->IpSec
.DisabledFlag
= TRUE
;
766 Private
->IsIPsecDisabling
= FALSE
;
772 // Delete established IKEv2 SAs.
774 if (!IsListEmpty (&Private
->Ikev2EstablishedList
)) {
775 for (Entry
= Private
->Ikev2EstablishedList
.ForwardLink
; Entry
!= &Private
->Ikev2EstablishedList
;) {
776 Ikev2SaSession
= IKEV2_SA_SESSION_BY_SESSION (Entry
);
777 Entry
= Entry
->ForwardLink
;
779 Ikev2SaSession
->SessionCommon
.State
= IkeStateSaDeleting
;
782 // Call for Information Exchange.
784 IkeVersion
= IkeGetVersionFromSession ((UINT8
*)Ikev2SaSession
);
785 if (IkeVersion
== 2) {
786 Exchange
= mIkeExchange
[IkeVersion
- 1];
787 Exchange
->NegotiateInfo((UINT8
*)Ikev2SaSession
, NULL
);