NetworkPkg/IpSecDxe/IkeService.c

   1 /** @file
   2   Provide IPsec Key Exchange (IKE) service general interfaces.
   3
   4   Copyright (c) 2010, Intel Corporation. All rights reserved.<BR>
   5
   6   This program and the accompanying materials
   7   are licensed and made available under the terms and conditions of the BSD License
   8   which accompanies this distribution.  The full text of the license may be found at
   9   http://opensource.org/licenses/bsd-license.php.
  10
  11   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  12   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  13
  14 **/
  15
  16 #include "IkeService.h"
  17 #include "IpSecConfigImpl.h"
  18 #include "Ikev2/Utility.h"
  19
  20 IKE_EXCHANGE_INTERFACE  *mIkeExchange[] = {
  21   &mIkev1Exchange,
  22   &mIkev2Exchange
  23 };
  24
  25 EFI_UDP4_CONFIG_DATA    mUdp4Conf = {
  26   FALSE,
  27   FALSE,
  28   FALSE,
  29   TRUE,
  30   //
  31   // IO parameters
  32   //
  33   0,
  34   64,
  35   FALSE,
  36   0,
  37   1000000,
  38   FALSE,
  39   {0,0,0,0},
  40   {0,0,0,0},
  41   IKE_DEFAULT_PORT,
  42   {0,0,0,0},
  43   0
  44 };
  45
  46 EFI_UDP6_CONFIG_DATA    mUdp6Conf = {
  47   FALSE,
  48   FALSE,
  49   TRUE,
  50   //
  51   // IO parameters
  52   //
  53   0,
  54   128,
  55   0,
  56   1000000,
  57   //Access Point
  58   {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0},
  59   IKE_DEFAULT_PORT,
  60   {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0},
  61   0
  62 };
  63
  64 /**
  65   Check if the NIC handle is binded to a Udp service.
  66
  67   @param[in]  Private    Pointer of IPSEC_PRIVATE_DATA.
  68   @param[in]  NicHandle  The Handle of the NIC card.
  69   @param[in]  IpVersion  The version of the IP stack.
  70
  71   @return a pointer of IKE_UDP_SERVICE.
  72
  73 **/
  74 IKE_UDP_SERVICE *
  75 IkeLookupUdp (
  76   IN IPSEC_PRIVATE_DATA     *Private,
  77   IN EFI_HANDLE             Handle,
  78   IN UINT8                  IpVersion
  79   )
  80 {
  81   LIST_ENTRY      *Head;
  82   LIST_ENTRY      *Entry;
  83   LIST_ENTRY      *Next;
  84   IKE_UDP_SERVICE *Udp;
  85
  86   Udp   = NULL;
  87   Head  = (IpVersion == IP_VERSION_4) ? &Private->Udp4List : &Private->Udp6List;
  88
  89   NET_LIST_FOR_EACH_SAFE (Entry, Next, Head) {
  90
  91     Udp = IPSEC_UDP_SERVICE_FROM_LIST (Entry);
  92     //
  93     // Find the right udp service which installed on the appointed NIC handle.
  94     //
  95     if (Handle == Udp->NicHandle) {
  96       break;
  97     } else {
  98       Udp = NULL;
  99     }
 100   }
 101
 102   return Udp;
 103 }
 104
 105 /**
 106   Configure a UDPIO's UDP4 instance.
 107
 108   This fuction is called by the UdpIoCreateIo() to configures a
 109   UDP4 instance.
 110
 111   @param[in] UdpIo         The UDP_IO to be configured.
 112   @param[in] Context       User-defined data when calling UdpIoCreateIo().
 113
 114   @retval EFI_SUCCESS      The configuration succeeded.
 115   @retval Others           The UDP4 instance fails to configure.
 116
 117 **/
 118 EFI_STATUS
 119 IkeConfigUdp4 (
 120   IN UDP_IO                 *UdpIo,
 121   IN VOID                   *Context
 122   )
 123 {
 124   EFI_UDP4_CONFIG_DATA  Udp4Cfg;
 125   EFI_UDP4_PROTOCOL     *Udp4;
 126
 127   ZeroMem (&Udp4Cfg, sizeof (EFI_UDP4_CONFIG_DATA));
 128
 129   Udp4 = UdpIo->Protocol.Udp4;
 130   CopyMem (
 131     &Udp4Cfg,
 132     &mUdp4Conf,
 133     sizeof (EFI_UDP4_CONFIG_DATA)
 134     );
 135
 136   if (Context != NULL) {
 137     //
 138     // Configure udp4 io with local default address.
 139     //
 140     Udp4Cfg.UseDefaultAddress = TRUE;
 141   }
 142
 143   return Udp4->Configure (Udp4, &Udp4Cfg);
 144 }
 145
 146 /**
 147   Configure a UDPIO's UDP6 instance.
 148
 149   This fuction is called by the UdpIoCreateIo()to configure a
 150   UDP6 instance.
 151
 152   @param[in] UdpIo         The UDP_IO to be configured.
 153   @param[in] Context       User-defined data when calling UdpIoCreateIo().
 154
 155   @retval EFI_SUCCESS      The configuration succeeded.
 156   @retval Others           The configuration fails.
 157
 158 **/
 159 EFI_STATUS
 160 IkeConfigUdp6 (
 161   IN UDP_IO                 *UdpIo,
 162   IN VOID                   *Context
 163   )
 164 {
 165   EFI_UDP6_PROTOCOL     *Udp6;
 166   EFI_UDP6_CONFIG_DATA  Udp6Cfg;
 167
 168   ZeroMem (&Udp6Cfg, sizeof (EFI_UDP6_CONFIG_DATA));
 169
 170   Udp6 = UdpIo->Protocol.Udp6;
 171   CopyMem (
 172     &Udp6Cfg,
 173     &mUdp6Conf,
 174     sizeof (EFI_UDP6_CONFIG_DATA)
 175     );
 176
 177   if (Context != NULL) {
 178     //
 179     // Configure instance with a destination address to start source address
 180     // selection, and then get the configure data from the mode data to store
 181     // the source address.
 182     //
 183     CopyMem (
 184       &Udp6Cfg.RemoteAddress,
 185       Context,
 186       sizeof (EFI_IPv6_ADDRESS)
 187       );
 188   }
 189
 190   return Udp6->Configure (Udp6, &Udp6Cfg);
 191 }
 192
 193 /**
 194   Open and configure the related output UDPIO for IKE packet sending.
 195
 196   If the UdpService is not configured, this fuction calls UdpIoCreatIo() to
 197   create UDPIO to bind this UdpService for IKE packet sending. If the UdpService
 198   has already been configured, then return.
 199
 200   @param[in] UdpService     The UDP_IO to be configured.
 201   @param[in] RemoteIp       User-defined data when calling UdpIoCreateIo().
 202
 203   @retval EFI_SUCCESS      The configuration is successful.
 204   @retval Others           The configuration fails.
 205
 206 **/
 207 EFI_STATUS
 208 IkeOpenOutputUdp (
 209   IN IKE_UDP_SERVICE           *UdpService,
 210   IN EFI_IP_ADDRESS            *RemoteIp
 211   )
 212 {
 213   EFI_STATUS              Status;
 214   EFI_IP4_CONFIG_PROTOCOL *Ip4Cfg;
 215   EFI_IP4_IPCONFIG_DATA   *Ip4CfgData;
 216   UINTN                   BufSize;
 217   EFI_IP6_MODE_DATA       Ip6ModeData;
 218   EFI_UDP6_PROTOCOL       *Udp6;
 219
 220   Status      = EFI_SUCCESS;
 221   Ip4CfgData  = NULL;
 222   BufSize     = 0;
 223
 224   //
 225   // Check whether the input and output udp io are both configured.
 226   //
 227   if (UdpService->IsConfigured) {
 228     goto ON_EXIT;
 229   }
 230
 231   if (UdpService->IpVersion == UDP_IO_UDP4_VERSION) {
 232     //
 233     // Handle ip4config protocol to get local default address.
 234     //
 235     Status = gBS->HandleProtocol (
 236                     UdpService->NicHandle,
 237                     &gEfiIp4ConfigProtocolGuid,
 238                     (VOID **) &Ip4Cfg
 239                     );
 240
 241     if (EFI_ERROR (Status)) {
 242       goto ON_EXIT;
 243     }
 244
 245     Status = Ip4Cfg->GetData (Ip4Cfg, &BufSize, NULL);
 246
 247     if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {
 248       goto ON_EXIT;
 249     }
 250
 251     Ip4CfgData = AllocateZeroPool (BufSize);
 252
 253     if (Ip4CfgData == NULL) {
 254       Status = EFI_OUT_OF_RESOURCES;
 255       goto ON_EXIT;
 256     }
 257
 258     Status = Ip4Cfg->GetData (Ip4Cfg, &BufSize, Ip4CfgData);
 259     if (EFI_ERROR (Status)) {
 260       goto ON_EXIT;
 261     }
 262
 263     CopyMem (
 264       &UdpService->DefaultAddress.v4,
 265       &Ip4CfgData->StationAddress,
 266       sizeof (EFI_IPv4_ADDRESS)
 267       );
 268
 269     //
 270     // Create udp4 io for output with local default address.
 271     //
 272     UdpService->Output = UdpIoCreateIo (
 273                            UdpService->NicHandle,
 274                            UdpService->ImageHandle,
 275                            IkeConfigUdp4,
 276                            UDP_IO_UDP4_VERSION,
 277                            &UdpService->DefaultAddress
 278                            );
 279
 280     if (UdpService->Output == NULL) {
 281       Status = EFI_OUT_OF_RESOURCES;
 282       goto ON_EXIT;
 283     }
 284
 285   } else {
 286     //
 287     // Create udp6 io for output with remote address.
 288     //
 289     UdpService->Output = UdpIoCreateIo (
 290                            UdpService->NicHandle,
 291                            UdpService->ImageHandle,
 292                            IkeConfigUdp6,
 293                            UDP_IO_UDP6_VERSION,
 294                            RemoteIp
 295                            );
 296
 297     if (UdpService->Output == NULL) {
 298       Status = EFI_OUT_OF_RESOURCES;
 299       goto ON_EXIT;
 300     }
 301     //
 302     // Get ip6 mode data to get the result of source address selection.
 303     //
 304     ZeroMem (&Ip6ModeData, sizeof (EFI_IP6_MODE_DATA));
 305
 306     Udp6    = UdpService->Output->Protocol.Udp6;
 307     Status  = Udp6->GetModeData (Udp6, NULL, &Ip6ModeData, NULL, NULL);
 308
 309     if (EFI_ERROR (Status)) {
 310       UdpIoFreeIo (UdpService->Output);
 311       goto ON_EXIT;
 312     }
 313     //
 314     // Reconfigure udp6 io without remote address.
 315     //
 316     Udp6->Configure (Udp6, NULL);
 317     Status = IkeConfigUdp6 (UdpService->Output, NULL);
 318
 319     //
 320     // Record the selected source address for ipsec process later.
 321     //
 322     CopyMem (
 323       &UdpService->DefaultAddress.v6,
 324       &Ip6ModeData.ConfigData.StationAddress,
 325       sizeof (EFI_IPv6_ADDRESS)
 326       );
 327   }
 328
 329   UdpService->IsConfigured = TRUE;
 330
 331 ON_EXIT:
 332   if (Ip4CfgData != NULL) {
 333     FreePool (Ip4CfgData);
 334   }
 335
 336   return Status;
 337 }
 338
 339 /**
 340   Open and configure a UDPIO of Udp4 for IKE packet receiving.
 341
 342   This function is called at the IPsecDriverBinding start. IPsec create a UDP4 and
 343   UDP4 IO for each NIC handle.
 344
 345   @param[in] Private        Point to IPSEC_PRIVATE_DATA
 346   @param[in] Controller     Handler for NIC card.
 347
 348   @retval EFI_SUCCESS             The Operation is successful.
 349   @retval EFI_OUT_OF_RESOURCE     The required system resource can't be allocated.
 350
 351 **/
 352 EFI_STATUS
 353 IkeOpenInputUdp4 (
 354   IN IPSEC_PRIVATE_DATA           *Private,
 355   IN EFI_HANDLE                   Controller
 356   )
 357 {
 358   IKE_UDP_SERVICE *Udp4Srv;
 359
 360   //
 361   // Check whether udp4 io of the controller has already been opened.
 362   //
 363   Udp4Srv = IkeLookupUdp (Private, Controller, IP_VERSION_4);
 364
 365   if (Udp4Srv != NULL) {
 366     return EFI_ALREADY_STARTED;
 367   }
 368
 369   Udp4Srv = AllocateZeroPool (sizeof (IKE_UDP_SERVICE));
 370
 371   if (Udp4Srv == NULL) {
 372     return EFI_OUT_OF_RESOURCES;
 373   }
 374   //
 375   // Create udp4 io for iutput.
 376   //
 377   Udp4Srv->Input = UdpIoCreateIo (
 378                      Controller,
 379                      Private->ImageHandle,
 380                      IkeConfigUdp4,
 381                      UDP_IO_UDP4_VERSION,
 382                      NULL
 383                      );
 384
 385   if (Udp4Srv->Input == NULL) {
 386     FreePool (Udp4Srv);
 387     return EFI_OUT_OF_RESOURCES;
 388   }
 389
 390   Udp4Srv->NicHandle    = Controller;
 391   Udp4Srv->ImageHandle  = Private->ImageHandle;
 392   Udp4Srv->ListHead     = &(Private->Udp4List);
 393   Udp4Srv->IpVersion    = UDP_IO_UDP4_VERSION;
 394   Udp4Srv->IsConfigured = FALSE;
 395
 396   ZeroMem (&Udp4Srv->DefaultAddress, sizeof (EFI_IP_ADDRESS));
 397
 398   //
 399   // Insert the udp4 io into the list and increase the count.
 400   //
 401   InsertTailList (&Private->Udp4List, &Udp4Srv->List);
 402
 403   Private->Udp4Num++;
 404
 405   UdpIoRecvDatagram (Udp4Srv->Input, IkeDispatch, Udp4Srv, 0);
 406
 407   return EFI_SUCCESS;
 408 }
 409
 410 /**
 411   Open and configure a UDPIO of Udp6 for IKE packet receiving.
 412
 413   This function is called at the IPsecDriverBinding start. IPsec create a UDP6 and UDP6
 414   IO for each NIC handle.
 415
 416   @param[in] Private        Point to IPSEC_PRIVATE_DATA
 417   @param[in] Controller     Handler for NIC card.
 418
 419   @retval EFI_SUCCESS             The Operation is successful.
 420   @retval EFI_OUT_OF_RESOURCE     The required system resource can't be allocated.
 421
 422 **/
 423 EFI_STATUS
 424 IkeOpenInputUdp6 (
 425   IN IPSEC_PRIVATE_DATA           *Private,
 426   IN EFI_HANDLE                   Controller
 427   )
 428 {
 429   IKE_UDP_SERVICE *Udp6Srv;
 430
 431   Udp6Srv = IkeLookupUdp (Private, Controller, IP_VERSION_6);
 432
 433   if (Udp6Srv != NULL) {
 434     return EFI_ALREADY_STARTED;
 435   }
 436
 437   Udp6Srv = AllocateZeroPool (sizeof (IKE_UDP_SERVICE));
 438
 439   if (Udp6Srv == NULL) {
 440     return EFI_OUT_OF_RESOURCES;
 441   }
 442   //
 443   // Create udp6 io for input.
 444   //
 445   Udp6Srv->Input = UdpIoCreateIo (
 446                      Controller,
 447                      Private->ImageHandle,
 448                      IkeConfigUdp6,
 449                      UDP_IO_UDP6_VERSION,
 450                      NULL
 451                      );
 452
 453   if (Udp6Srv->Input == NULL) {
 454     FreePool (Udp6Srv);
 455     return EFI_OUT_OF_RESOURCES;
 456   }
 457
 458   Udp6Srv->NicHandle    = Controller;
 459   Udp6Srv->ImageHandle  = Private->ImageHandle;
 460   Udp6Srv->ListHead     = &(Private->Udp6List);
 461   Udp6Srv->IpVersion    = UDP_IO_UDP6_VERSION;
 462   Udp6Srv->IsConfigured = FALSE;
 463
 464   ZeroMem (&Udp6Srv->DefaultAddress, sizeof (EFI_IP_ADDRESS));
 465
 466   //
 467   // Insert the udp6 io into the list and increase the count.
 468   //
 469   InsertTailList (&Private->Udp6List, &Udp6Srv->List);
 470
 471   Private->Udp6Num++;
 472
 473   UdpIoRecvDatagram (Udp6Srv->Input, IkeDispatch, Udp6Srv, 0);
 474
 475   return EFI_SUCCESS;
 476 }
 477
 478 /**
 479   The general interface of starting IPsec Key Exchange.
 480
 481   This function is called when a IKE negotiation to start getting a Key.
 482
 483   @param[in] UdpService   Point to IKE_UDP_SERVICE which will be used for
 484                           IKE packet sending.
 485   @param[in] SpdEntry     Point to the SPD entry related to the IKE negotiation.
 486   @param[in] RemoteIp     Point to EFI_IP_ADDRESS related to the IKE negotiation.
 487
 488   @retval EFI_SUCCESS            The Operation is successful.
 489   @retval EFI_ACCESS_DENIED      No related PAD entry was found.
 490   @retval EFI_INVALID_PARAMETER  The IKE version is not supported.
 491
 492 **/
 493 EFI_STATUS
 494 IkeNegotiate (
 495   IN IKE_UDP_SERVICE       *UdpService,
 496   IN IPSEC_SPD_ENTRY       *SpdEntry,
 497   IN EFI_IP_ADDRESS        *RemoteIp
 498   )
 499 {
 500   EFI_STATUS               Status;
 501   UINT8                    *IkeSaSession;
 502   IKE_EXCHANGE_INTERFACE   *Exchange;
 503   IPSEC_PRIVATE_DATA       *Private;
 504   IPSEC_PAD_ENTRY          *PadEntry;
 505   UINT8                    IkeVersion;
 506
 507   Private = (UdpService->IpVersion == IP_VERSION_4) ?
 508              IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :
 509              IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);
 510
 511   //
 512   // Try to open udp io for output if it hasn't.
 513   //
 514   Status = IkeOpenOutputUdp (UdpService, RemoteIp);
 515   if (EFI_ERROR (Status)) {
 516     return Status;
 517   }
 518   //
 519   // Try to find the IKE SA session in the IKEv1 and IKEv2 established SA session list.
 520   //
 521   IkeSaSession = (UINT8 *) Ikev2SaSessionLookup (&Private->Ikev2EstablishedList, RemoteIp);
 522
 523
 524   if (IkeSaSession == NULL) {
 525     //
 526     // Find the pad entry by the remote ip address.
 527     //
 528     PadEntry = IpSecLookupPadEntry (UdpService->IpVersion, RemoteIp);
 529     if (PadEntry == NULL) {
 530       return EFI_ACCESS_DENIED;
 531     }
 532     //
 533     // Determine the IKE exchange instance by the auth protocol in pad entry.
 534     //
 535     ASSERT (PadEntry->Data->AuthProtocol < EfiIPsecAuthProtocolMaximum);
 536     if (PadEntry->Data->AuthProtocol == EfiIPsecAuthProtocolIKEv1) {
 537       return EFI_INVALID_PARAMETER;
 538     }
 539     Exchange = mIkeExchange[PadEntry->Data->AuthProtocol];
 540     //
 541     // Start the main mode stage to negotiate IKE SA.
 542     //
 543     Status = Exchange->NegotiateSa (UdpService, SpdEntry, PadEntry, RemoteIp);
 544   } else {
 545     //
 546     // Determine the IKE exchange instance by the IKE version in IKE SA session.
 547     //
 548     IkeVersion = IkeGetVersionFromSession (IkeSaSession);
 549     if (IkeVersion != 2) {
 550       return EFI_INVALID_PARAMETER;
 551     }
 552
 553     Exchange = mIkeExchange[IkeVersion - 1];
 554     //
 555     // Start the quick mode stage to negotiate child SA.
 556     //
 557     Status = Exchange->NegotiateChildSa (IkeSaSession, SpdEntry, NULL);
 558   }
 559
 560   return Status;
 561 }
 562
 563 /**
 564   The generic interface when receive a IKE packet.
 565
 566   This function is called when UDP IO receives a IKE packet.
 567
 568   @param[in] Packet       Point to received IKE packet.
 569   @param[in] EndPoint     Point to UDP_END_POINT which contains the information of
 570                           Remote IP and Port.
 571   @param[in] IoStatus     The Status of Recieve Token.
 572   @param[in] Context      Point to data passed from the caller.
 573
 574 **/
 575 VOID
 576 IkeDispatch (
 577   IN NET_BUF                        *Packet,
 578   IN UDP_END_POINT                  *EndPoint,
 579   IN EFI_STATUS                     IoStatus,
 580   IN VOID                           *Context
 581   )
 582 {
 583   IPSEC_PRIVATE_DATA                *Private;
 584   IKE_PACKET                        *IkePacket;
 585   IKE_HEADER                        *IkeHdr;
 586   IKE_UDP_SERVICE                   *UdpService;
 587   IKE_EXCHANGE_INTERFACE            *Exchange;
 588   EFI_STATUS                        Status;
 589
 590   UdpService = (IKE_UDP_SERVICE *) Context;
 591   IkePacket  = NULL;
 592   Private    = (UdpService->IpVersion == IP_VERSION_4) ?
 593                IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :
 594                IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);
 595
 596   if (EFI_ERROR (IoStatus)) {
 597     goto ON_EXIT;
 598   }
 599   //
 600   // Check whether the ipsec is enabled or not.
 601   //
 602   if (Private->IpSec.DisabledFlag == TRUE) {
 603     goto ON_EXIT;
 604   }
 605
 606   if (EndPoint->RemotePort != IKE_DEFAULT_PORT) {
 607     goto ON_EXIT;
 608   }
 609
 610   //
 611   // Build IKE packet from the received netbuf.
 612   //
 613   IkePacket = IkePacketFromNetbuf (Packet);
 614
 615   if (IkePacket == NULL) {
 616     goto ON_EXIT;
 617   }
 618   //
 619   // Get the remote address from the IKE packet.
 620   //
 621   if (UdpService->IpVersion == IP_VERSION_4) {
 622     *(UINT32 *) IkePacket->RemotePeerIp.Addr = HTONL ((*(UINT32 *) EndPoint->RemoteAddr.Addr));
 623   } else {
 624     CopyMem (
 625       &IkePacket->RemotePeerIp,
 626       NTOHLLL (&EndPoint->RemoteAddr.v6),
 627       sizeof (EFI_IPv6_ADDRESS)
 628       );
 629   }
 630   //
 631   // Try to open udp io for output if hasn't.
 632   //
 633   Status = IkeOpenOutputUdp (UdpService, &IkePacket->RemotePeerIp);
 634
 635   if (EFI_ERROR (Status)) {
 636     goto ON_EXIT;
 637   }
 638
 639   IkeHdr = IkePacket->Header;
 640
 641   //
 642   // Determine the IKE exchange instance by the IKE version in IKE header.
 643   //
 644   if (IKE_MAJOR_VERSION (IkeHdr->Version) == 2) {
 645     Exchange = mIkeExchange[IKE_MAJOR_VERSION (IkeHdr->Version) - 1];
 646   } else {
 647     goto ON_EXIT;
 648   }
 649
 650   switch (IkeHdr->ExchangeType) {
 651   case IKE_XCG_TYPE_IDENTITY_PROTECT:
 652   case IKE_XCG_TYPE_SA_INIT:
 653   case IKE_XCG_TYPE_AUTH:
 654     Exchange->HandleSa (UdpService, IkePacket);
 655     break;
 656
 657   case IKE_XCG_TYPE_QM:
 658   case IKE_XCG_TYPE_CREATE_CHILD_SA:
 659     Exchange->HandleChildSa (UdpService, IkePacket);
 660     break;
 661
 662   case IKE_XCG_TYPE_INFO:
 663   case IKE_XCG_TYPE_INFO2:
 664     Exchange->HandleInfo (UdpService, IkePacket);
 665     break;
 666
 667   default:
 668     break;
 669   }
 670
 671 ON_EXIT:
 672   if (IkePacket != NULL) {
 673     IkePacketFree (IkePacket);
 674   }
 675
 676   if (Packet != NULL) {
 677     NetbufFree (Packet);
 678   }
 679
 680   UdpIoRecvDatagram (UdpService->Input, IkeDispatch, UdpService, 0);
 681
 682   return ;
 683 }
 684
 685 /**
 686   Delete all established IKE SAs and related Child SAs.
 687
 688   This function is the subfunction of the IpSecCleanupAllSa(). It first calls
 689   IkeDeleteChildSa() to delete all Child SAs then send out the related
 690   Information packet.
 691
 692   @param[in]  Private  Pointer of the IPSEC_PRIVATE_DATA
 693
 694 **/
 695 VOID
 696 IkeDeleteAllSas (
 697   IN IPSEC_PRIVATE_DATA  *Private
 698   )
 699 {
 700   LIST_ENTRY             *Entry;
 701   LIST_ENTRY             *NextEntry;
 702   IKEV2_SA_SESSION       *Ikev2SaSession;
 703   UINT8                  Value;
 704   EFI_STATUS             Status;
 705   IKE_EXCHANGE_INTERFACE *Exchange;
 706   UINT8                  IkeVersion;
 707
 708   Exchange = NULL;
 709
 710   //
 711   // If the IKEv1 is supported, first deal with the Ikev1Estatblished list.
 712   //
 713
 714   //
 715   // If IKEv2 SAs are under establishing, delete it directly.
 716   //
 717   if (!IsListEmpty (&Private->Ikev2SessionList)) {
 718     NET_LIST_FOR_EACH_SAFE (Entry, NextEntry, &Private->Ikev2SessionList) {
 719       Ikev2SaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);
 720       RemoveEntryList (Entry);
 721       Ikev2SaSessionFree (Ikev2SaSession);
 722     }
 723   }
 724
 725   //
 726   // If there is no existing established IKE SA, set the Ipsec DisableFlag to TRUE
 727   // and turn off the IsIPsecDisabling flag.
 728   //
 729   if (IsListEmpty (&Private->Ikev2EstablishedList)) {
 730     Value = IPSEC_STATUS_DISABLED;
 731     Status = gRT->SetVariable (
 732                IPSECCONFIG_STATUS_NAME,
 733                &gEfiIpSecConfigProtocolGuid,
 734                EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_NON_VOLATILE,
 735                sizeof (Value),
 736                &Value
 737                );
 738     if (!EFI_ERROR (Status)) {
 739       Private->IpSec.DisabledFlag = TRUE;
 740       Private->IsIPsecDisabling   = FALSE;
 741       return ;
 742     }
 743   }
 744
 745   //
 746   // Delete established IKEv2 SAs.
 747   //
 748   if (!IsListEmpty (&Private->Ikev2EstablishedList)) {
 749     for (Entry = Private->Ikev2EstablishedList.ForwardLink; Entry != &Private->Ikev2EstablishedList;) {
 750       Ikev2SaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);
 751       Entry = Entry->ForwardLink;
 752
 753       Ikev2SaSession->SessionCommon.State = IkeStateSaDeleting;
 754
 755       //
 756       // Call for Information Exchange.
 757       //
 758       IkeVersion = IkeGetVersionFromSession ((UINT8*)Ikev2SaSession);
 759       if (IkeVersion == 2) {
 760         Exchange = mIkeExchange[IkeVersion - 1];
 761         Exchange->NegotiateInfo((UINT8*)Ikev2SaSession, NULL);
 762       }
 763     }
 764   }
 765
 766 }
 767
 768
 769