NetworkPkg/IpSecDxe/Ikev2/Exchange.c

   1 /** @file
   2   The general interfaces of the IKEv2.
   3
   4   Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR>
   5
   6   SPDX-License-Identifier: BSD-2-Clause-Patent
   7
   8 **/
   9
  10 #include "Utility.h"
  11 #include "IpSecDebug.h"
  12 #include "IkeService.h"
  13 #include "IpSecConfigImpl.h"
  14
  15 /**
  16   General interface to intialize a IKEv2 negotiation.
  17
  18   @param[in]  UdpService      Point to Udp Servcie used for the IKE packet sending.
  19   @param[in]  SpdEntry        Point to SPD entry related to this IKE negotiation.
  20   @param[in]  PadEntry        Point to PAD entry related to this IKE negotiation.
  21   @param[in]  RemoteIp        Point to IP Address which the remote peer to negnotiate.
  22
  23   @retval EFI_SUCCESS           The operation is successful.
  24   @retval EFI_OUT_OF_RESOURCES  The required system resource can't be allocated.
  25   @retval EFI_INVALID_PARAMETER If UdpService or RemoteIp is NULL.
  26   @return Others                The operation is failed.
  27
  28 **/
  29 EFI_STATUS
  30 Ikev2NegotiateSa (
  31   IN IKE_UDP_SERVICE         *UdpService,
  32   IN IPSEC_SPD_ENTRY         *SpdEntry,
  33   IN IPSEC_PAD_ENTRY         *PadEntry,
  34   IN EFI_IP_ADDRESS          *RemoteIp
  35   )
  36 {
  37   IPSEC_PRIVATE_DATA        *Private;
  38   IKEV2_SA_SESSION          *IkeSaSession;
  39   IKEV2_SESSION_COMMON      *SessionCommon;
  40   IKEV2_PACKET_HANDLER      Handler;
  41   IKE_PACKET                *IkePacket;
  42   EFI_STATUS                Status;
  43
  44   if (UdpService == NULL || RemoteIp == NULL) {
  45     return EFI_INVALID_PARAMETER;
  46   }
  47
  48   IkePacket = NULL;
  49   Private   = (UdpService->IpVersion == IP_VERSION_4) ?
  50                IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :
  51                IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);
  52
  53   //
  54   // Lookup the remote ip address in the processing IKE SA session list.
  55   //
  56   IkeSaSession = Ikev2SaSessionLookup (&Private->Ikev2SessionList, RemoteIp);
  57   if (IkeSaSession != NULL) {
  58     //
  59     // Drop the packet if already in process.
  60     //
  61     return EFI_SUCCESS;
  62   }
  63
  64   //
  65   // Create a new IkeSaSession and initiate the common parameters.
  66   //
  67   IkeSaSession = Ikev2SaSessionAlloc (Private, UdpService);
  68   if (IkeSaSession == NULL) {
  69     return EFI_OUT_OF_RESOURCES;
  70   }
  71
  72   //
  73   // Set the specific parameters and state(IKE_STATE_INIT).
  74   //
  75   IkeSaSession->Spd            = SpdEntry;
  76   IkeSaSession->Pad            = PadEntry;
  77   SessionCommon                = &IkeSaSession->SessionCommon;
  78   SessionCommon->IsInitiator   = TRUE;
  79   SessionCommon->State         = IkeStateInit;
  80   //
  81   // TODO: Get the prefer DH Group from the IPsec Configuration, after the IPsecconfig application update
  82   // to support it.
  83   //
  84   SessionCommon->PreferDhGroup = IKEV2_TRANSFORM_ID_DH_1024MODP;
  85
  86   CopyMem (
  87     &SessionCommon->RemotePeerIp,
  88     RemoteIp,
  89     sizeof (EFI_IP_ADDRESS)
  90     );
  91
  92   CopyMem (
  93     &SessionCommon->LocalPeerIp,
  94     &UdpService->DefaultAddress,
  95     sizeof (EFI_IP_ADDRESS)
  96     );
  97
  98   IKEV2_DUMP_STATE (SessionCommon->State, IkeStateInit);
  99
 100   //
 101   // Initiate the SAD data of the IkeSaSession.
 102   //
 103   IkeSaSession->SaData = Ikev2InitializeSaData (SessionCommon);
 104   if (IkeSaSession->SaData == NULL) {
 105     Status = EFI_OUT_OF_RESOURCES;
 106     goto ON_ERROR;
 107   }
 108
 109   //
 110   // Generate an IKE request packet and send it out.
 111   //
 112   Handler   = mIkev2Initial[IkeSaSession->Pad->Data->AuthMethod][SessionCommon->State];
 113   IkePacket = Handler.Generator ((UINT8 *) IkeSaSession, NULL);
 114   if (IkePacket == NULL) {
 115     Status = EFI_OUT_OF_RESOURCES;
 116     goto ON_ERROR;
 117   }
 118
 119   Status = Ikev2SendIkePacket (UdpService, (UINT8 *) SessionCommon, IkePacket, 0);
 120
 121   if (EFI_ERROR (Status)) {
 122     goto ON_ERROR;
 123   }
 124
 125   //
 126   // Insert the current IkeSaSession into the processing IKE SA list.
 127   //
 128   Ikev2SaSessionInsert (&Private->Ikev2SessionList, IkeSaSession, RemoteIp);
 129
 130   return EFI_SUCCESS;
 131
 132 ON_ERROR:
 133
 134   if (IkePacket != NULL) {
 135     IkePacketFree (IkePacket);
 136   }
 137   Ikev2SaSessionFree (IkeSaSession);
 138   return Status;
 139 }
 140
 141 /**
 142   It is general interface to negotiate the Child SA.
 143
 144   There are three situations which will invoke this function. First, create a CHILD
 145   SA if the input Context is NULL. Second, rekeying the existing IKE SA if the Context
 146   is a IKEv2_SA_SESSION. Third, rekeying the existing CHILD SA if the context is a
 147   IKEv2_CHILD_SA_SESSION.
 148
 149   @param[in] IkeSaSession  Pointer to IKEv2_SA_SESSION related to this operation.
 150   @param[in] SpdEntry      Pointer to IPSEC_SPD_ENTRY related to this operation.
 151   @param[in] Context       The data pass from the caller.
 152
 153   @retval EFI_SUCCESS          The operation is successful.
 154   @retval EFI_OUT_OF_RESOURCES The required system resource can't be allocated.
 155   @retval EFI_UNSUPPORTED      The condition is not support yet.
 156   @return Others               The operation is failed.
 157
 158 **/
 159 EFI_STATUS
 160 Ikev2NegotiateChildSa (
 161   IN UINT8           *IkeSaSession,
 162   IN IPSEC_SPD_ENTRY *SpdEntry,
 163   IN UINT8           *Context
 164   )
 165 {
 166   EFI_STATUS                Status;
 167   IKEV2_SA_SESSION          *SaSession;
 168   IKEV2_CHILD_SA_SESSION    *ChildSaSession;
 169   IKEV2_SESSION_COMMON      *ChildSaCommon;
 170   IKE_PACKET                *IkePacket;
 171   IKE_UDP_SERVICE           *UdpService;
 172
 173   SaSession  = (IKEV2_SA_SESSION*) IkeSaSession;
 174   UdpService = SaSession->SessionCommon.UdpService;
 175   IkePacket  = NULL;
 176
 177   //
 178   // 1. Create another child SA session if context is null.
 179   // 2. Rekeying the IKE SA session if the context is IKE SA session.
 180   // 3. Rekeying the child SA session if the context is child SA session.
 181   //
 182   if (Context == NULL) {
 183     //
 184     // Create a new ChildSaSession and initiate the common parameters.
 185     //
 186     ChildSaSession = Ikev2ChildSaSessionAlloc (UdpService, SaSession);
 187
 188     if (ChildSaSession == NULL) {
 189       return EFI_OUT_OF_RESOURCES;
 190     }
 191
 192     //
 193     // Set the specific parameters and state as IKE_STATE_CREATE_CHILD.
 194     //
 195     ChildSaSession->Spd         = SpdEntry;
 196     ChildSaCommon               = &ChildSaSession->SessionCommon;
 197     ChildSaCommon->IsInitiator  = TRUE;
 198     ChildSaCommon->State        = IkeStateCreateChild;
 199
 200     IKEV2_DUMP_STATE (ChildSaCommon->State, IkeStateCreateChild);
 201
 202     if (SpdEntry->Selector->NextLayerProtocol != EFI_IPSEC_ANY_PROTOCOL) {
 203       ChildSaSession->ProtoId = SpdEntry->Selector->NextLayerProtocol;
 204     }
 205
 206     if (SpdEntry->Selector->LocalPort != EFI_IPSEC_ANY_PORT) {
 207       ChildSaSession->LocalPort = SpdEntry->Selector->LocalPort;
 208     }
 209
 210     if (SpdEntry->Selector->RemotePort != EFI_IPSEC_ANY_PORT) {
 211       ChildSaSession->RemotePort = SpdEntry->Selector->RemotePort;
 212     }
 213     //
 214     // Initiate the SAD data parameters of the ChildSaSession.
 215     //
 216     ChildSaSession->SaData = Ikev2InitializeSaData (ChildSaCommon);
 217     if (ChildSaSession->SaData == NULL) {
 218       Status = EFI_OUT_OF_RESOURCES;
 219       goto ON_ERROR;
 220     }
 221     //
 222     // Generate an IKE request packet and send it out.
 223     //
 224     IkePacket = mIkev2CreateChild.Generator ((UINT8 *) ChildSaSession, NULL);
 225
 226     if (IkePacket == NULL) {
 227       Status = EFI_OUT_OF_RESOURCES;
 228       goto ON_ERROR;
 229     }
 230
 231     Status = Ikev2SendIkePacket (UdpService, (UINT8 *) ChildSaCommon, IkePacket, 0);
 232
 233     if (EFI_ERROR (Status)) {
 234       goto ON_ERROR;
 235     }
 236
 237     //
 238     // Insert the ChildSaSession into processing child SA list.
 239     //
 240     Ikev2ChildSaSessionInsert (&SaSession->ChildSaSessionList, ChildSaSession);
 241   } else {
 242     //
 243     // TODO: Rekeying IkeSaSession or ChildSaSession, NOT support yet.
 244     //
 245     // Rekey IkeSa, set IkeSaSession->State and pass over IkeSaSession
 246     // Rekey ChildSa, set ChildSaSession->State and pass over ChildSaSession
 247     //
 248     return EFI_UNSUPPORTED;
 249   }
 250
 251   return EFI_SUCCESS;
 252
 253 ON_ERROR:
 254
 255   if (ChildSaSession->SaData != NULL) {
 256     FreePool (ChildSaSession->SaData);
 257   }
 258
 259   if (ChildSaSession->SessionCommon.TimeoutEvent != NULL) {
 260     gBS->CloseEvent (ChildSaSession->SessionCommon.TimeoutEvent);
 261   }
 262
 263   if (IkePacket != NULL) {
 264     IkePacketFree (IkePacket);
 265   }
 266
 267   Ikev2ChildSaSessionFree (ChildSaSession);
 268   return Status;
 269 }
 270
 271 /**
 272   It is general interface to start the Information Exchange.
 273
 274   There are three situations which will invoke this function. First, deliver a Delete Information
 275   to delete the IKE SA if the input Context is NULL and the state of related IkeSaSeesion's is on
 276   deleting.Second, deliver a Notify Information without the contents if the input Context is NULL.
 277   Third, deliver a Notify Information if the input Context is not NULL.
 278
 279   @param[in] IkeSaSession  Pointer to IKEv2_SA_SESSION related to this operation.
 280   @param[in] Context       Data passed by caller.
 281
 282   @retval EFI_SUCCESS          The operation is successful.
 283   @retval EFI_OUT_OF_RESOURCES The required system resource can't be allocated.
 284   @retval EFI_UNSUPPORTED      The condition is not support yet.
 285   @return Otherwise            The operation is failed.
 286
 287 **/
 288 EFI_STATUS
 289 Ikev2NegotiateInfo (
 290   IN UINT8           *IkeSaSession,
 291   IN UINT8           *Context
 292   )
 293 {
 294
 295   EFI_STATUS                Status;
 296   IKEV2_SA_SESSION          *Ikev2SaSession;
 297   IKEV2_CHILD_SA_SESSION    *ChildSaSession;
 298   IKEV2_SESSION_COMMON      *SaCommon;
 299   IKE_PACKET                *IkePacket;
 300   IKE_UDP_SERVICE           *UdpService;
 301   LIST_ENTRY                *Entry;
 302   LIST_ENTRY                *NextEntry;
 303
 304   Ikev2SaSession = (IKEV2_SA_SESSION *) IkeSaSession;
 305   UdpService     = Ikev2SaSession->SessionCommon.UdpService;
 306   SaCommon       = &Ikev2SaSession->SessionCommon;
 307   IkePacket      = NULL;
 308   Status         = EFI_SUCCESS;
 309
 310   //
 311   // Delete the IKE SA.
 312   //
 313   if (Ikev2SaSession->SessionCommon.State == IkeStateSaDeleting && Context == NULL) {
 314
 315     //
 316     // Generate Information Packet which contains the Delete Payload.
 317     //
 318     IkePacket = mIkev2Info.Generator ((UINT8 *) Ikev2SaSession, NULL);
 319     if (IkePacket == NULL) {
 320       Status = EFI_OUT_OF_RESOURCES;
 321       goto ON_ERROR;
 322     }
 323
 324     //
 325     // Send out the Packet
 326     //
 327     if (UdpService != NULL && UdpService->Output != NULL) {
 328       Status = Ikev2SendIkePacket (UdpService, (UINT8 *) SaCommon, IkePacket, 0);
 329
 330       if (EFI_ERROR (Status)) {
 331         goto ON_ERROR;
 332       }
 333     }
 334   } else if (!IsListEmpty (&Ikev2SaSession->DeleteSaList)) {
 335     //
 336     // Iterate all Deleting Child SAs.
 337     //
 338     NET_LIST_FOR_EACH_SAFE (Entry, NextEntry, &Ikev2SaSession->DeleteSaList) {
 339       ChildSaSession                      = IKEV2_CHILD_SA_SESSION_BY_DEL_SA (Entry);
 340       ChildSaSession->SessionCommon.State = IkeStateSaDeleting;
 341
 342       //
 343       // Generate Information Packet which contains the Child SA Delete Payload.
 344       //
 345       IkePacket = mIkev2Info.Generator ((UINT8 *) ChildSaSession, NULL);
 346       if (IkePacket == NULL) {
 347         Status = EFI_OUT_OF_RESOURCES;
 348         goto ON_ERROR;
 349       }
 350
 351       //
 352       // Send out the Packet
 353       //
 354       if (UdpService != NULL && UdpService->Output != NULL) {
 355         Status = Ikev2SendIkePacket (UdpService, (UINT8 *) &ChildSaSession->SessionCommon, IkePacket, 0);
 356
 357         if (EFI_ERROR (Status)) {
 358           goto ON_ERROR;
 359         }
 360       }
 361     }
 362   }  else if (Context == NULL) {
 363     //
 364     // TODO: Deliver null notification message.
 365     //
 366   }  else if (Context != NULL) {
 367     //
 368     // TODO: Send out the Information Exchange which contains the Notify Payload.
 369     //
 370   }
 371 ON_ERROR:
 372   if (IkePacket != NULL) {
 373     IkePacketFree (IkePacket);
 374   }
 375   return Status;
 376
 377 }
 378
 379 /**
 380   The general interface when received a IKEv2 packet for the IKE SA establishing.
 381
 382   This function first find the related IKE SA Session according to the IKE packet's
 383   remote IP. Then call the corresponding function to handle this IKE packet according
 384   to the related IKE SA Session's State.
 385
 386   @param[in] UdpService    Pointer of related UDP Service.
 387   @param[in] IkePacket     Data passed by caller.
 388
 389 **/
 390 VOID
 391 Ikev2HandleSa (
 392   IN IKE_UDP_SERVICE     *UdpService,
 393   IN IKE_PACKET          *IkePacket
 394   )
 395 {
 396   EFI_STATUS              Status;
 397   IKEV2_SA_SESSION        *IkeSaSession;
 398   IKEV2_CHILD_SA_SESSION  *ChildSaSession;
 399   IKEV2_SESSION_COMMON    *IkeSaCommon;
 400   IKEV2_SESSION_COMMON    *ChildSaCommon;
 401   IKEV2_PACKET_HANDLER    Handler;
 402   IKE_PACKET              *Reply;
 403   IPSEC_PAD_ENTRY         *PadEntry;
 404   IPSEC_PRIVATE_DATA      *Private;
 405   BOOLEAN                 IsNewSession;
 406
 407   Private = (UdpService->IpVersion == IP_VERSION_4) ?
 408              IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :
 409              IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);
 410
 411   ChildSaSession = NULL;
 412   ChildSaCommon  = NULL;
 413
 414   //
 415   // Lookup the remote ip address in the processing IKE SA session list.
 416   //
 417   IkeSaSession = Ikev2SaSessionLookup (&Private->Ikev2SessionList, &IkePacket->RemotePeerIp);
 418   IsNewSession = FALSE;
 419
 420   if (IkeSaSession == NULL) {
 421     //
 422     // Lookup the remote ip address in the pad.
 423     //
 424     PadEntry = IpSecLookupPadEntry (UdpService->IpVersion, &IkePacket->RemotePeerIp);
 425     if (PadEntry == NULL) {
 426       //
 427       // Drop the packet if no pad entry matched, this is the request from RFC 4301.
 428       //
 429       return ;
 430     }
 431
 432     //
 433     // Create a new IkeSaSession and initiate the common parameters.
 434     //
 435     IkeSaSession             = Ikev2SaSessionAlloc (Private, UdpService);
 436     if (IkeSaSession == NULL) {
 437       return;
 438     }
 439     IkeSaSession->Pad        = PadEntry;
 440     IkeSaCommon              = &IkeSaSession->SessionCommon;
 441     IkeSaCommon->IsInitiator = FALSE;
 442     IkeSaCommon->State       = IkeStateInit;
 443
 444     IKEV2_DUMP_STATE (IkeSaCommon->State, IkeStateInit);
 445
 446     CopyMem (
 447       &IkeSaCommon->RemotePeerIp,
 448       &IkePacket->RemotePeerIp,
 449       sizeof (EFI_IP_ADDRESS)
 450       );
 451
 452     CopyMem (
 453       &IkeSaCommon->LocalPeerIp,
 454       &UdpService->DefaultAddress,
 455       sizeof (EFI_IP_ADDRESS)
 456       );
 457
 458     IsNewSession = TRUE;
 459   }
 460
 461   //
 462   // Validate the IKE packet header.
 463   //
 464   if (!Ikev2ValidateHeader (IkeSaSession, IkePacket->Header)) {
 465     //
 466     // Drop the packet if invalid IKE header.
 467     //
 468     goto ON_ERROR;
 469   }
 470
 471   //
 472   // Decode all the payloads in the IKE packet.
 473   //
 474   IkeSaCommon = &IkeSaSession->SessionCommon;
 475   Status      = Ikev2DecodePacket (IkeSaCommon, IkePacket, IkeSessionTypeIkeSa);
 476   if (EFI_ERROR (Status)) {
 477     goto ON_ERROR;
 478   }
 479
 480   //
 481   // Try to reate the first ChildSa Session of that IkeSaSession.
 482   // If the IkeSaSession is responder, here will create the first ChildSaSession.
 483   //
 484   if (IkeSaCommon->State == IkeStateAuth && IsListEmpty(&IkeSaSession->ChildSaSessionList)) {
 485     //
 486     // Generate a piggyback child SA in IKE_STATE_AUTH state.
 487     //
 488     ASSERT (IsListEmpty (&IkeSaSession->ChildSaSessionList) &&
 489             IsListEmpty (&IkeSaSession->ChildSaEstablishSessionList));
 490
 491     ChildSaSession = Ikev2ChildSaSessionCreate (IkeSaSession, UdpService);
 492     if (ChildSaSession == NULL) {
 493       goto ON_ERROR;
 494     }
 495
 496     ChildSaCommon  = &ChildSaSession->SessionCommon;
 497   }
 498
 499   //
 500   // Parse the IKE request packet according to the auth method and current state.
 501   //
 502   Handler = mIkev2Initial[IkeSaSession->Pad->Data->AuthMethod][IkeSaCommon->State];
 503   Status  = Handler.Parser ((UINT8 *)IkeSaSession, IkePacket);
 504   if (EFI_ERROR (Status)) {
 505     goto ON_ERROR;
 506   }
 507
 508   //
 509   // Try to reate the first ChildSa Session of that IkeSaSession.
 510   // If the IkeSaSession is initiator, here will create the first ChildSaSession.
 511   //
 512   if (IkeSaCommon->State == IkeStateAuth && IsListEmpty(&IkeSaSession->ChildSaSessionList)) {
 513     //
 514     // Generate a piggyback child SA in IKE_STATE_AUTH state.
 515     //
 516     ASSERT (IsListEmpty (&IkeSaSession->ChildSaSessionList) &&
 517             IsListEmpty (&IkeSaSession->ChildSaEstablishSessionList));
 518
 519     ChildSaSession = Ikev2ChildSaSessionCreate (IkeSaSession, UdpService);
 520     if (ChildSaSession == NULL) {
 521       goto ON_ERROR;
 522     }
 523
 524     ChildSaCommon  = &ChildSaSession->SessionCommon;
 525
 526     //
 527     // Initialize the SA data for Child SA.
 528     //
 529     ChildSaSession->SaData = Ikev2InitializeSaData (ChildSaCommon);
 530   }
 531
 532   //
 533   // Generate the IKE response packet and send it out if not established.
 534   //
 535   if (IkeSaCommon->State != IkeStateIkeSaEstablished) {
 536     Handler = mIkev2Initial[IkeSaSession->Pad->Data->AuthMethod][IkeSaCommon->State];
 537     Reply   = Handler.Generator ((UINT8 *) IkeSaSession, NULL);
 538     if (Reply == NULL) {
 539       goto ON_ERROR;
 540     }
 541
 542     Status = Ikev2SendIkePacket (UdpService, (UINT8 *) IkeSaCommon, Reply, 0);
 543     if (EFI_ERROR (Status)) {
 544       goto ON_ERROR;
 545     }
 546     if (!IkeSaCommon->IsInitiator) {
 547       IkeSaCommon->State ++;
 548       IKEV2_DUMP_STATE (IkeSaCommon->State - 1, IkeSaCommon->State);
 549     }
 550   }
 551
 552   //
 553   // Insert the new IkeSaSession into the Private processing IkeSaSession List.
 554   //
 555   if (IsNewSession) {
 556     Ikev2SaSessionInsert (&Private->Ikev2SessionList, IkeSaSession, &IkePacket->RemotePeerIp);
 557   }
 558
 559   //
 560   // Register the IkeSaSession and remove it from processing list.
 561   //
 562   if (IkeSaCommon->State == IkeStateIkeSaEstablished) {
 563
 564     //
 565     // Remove the Established IKE SA Session from the IKE SA Session Negotiating list
 566     // and insert it into IKE SA Session Established list.
 567     //
 568     Ikev2SaSessionRemove (&Private->Ikev2SessionList, &IkePacket->RemotePeerIp);
 569     Ikev2SaSessionReg (IkeSaSession, Private);
 570
 571     //
 572     // Remove the Established Child SA Session from the IkeSaSession->ChildSaSessionList
 573     // ,insert it into IkeSaSession->ChildSaEstablishSessionList and save this Child SA
 574     // into SAD.
 575     //
 576     ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (IkeSaSession->ChildSaSessionList.BackLink);
 577     Ikev2ChildSaSessionRemove (
 578       &IkeSaSession->ChildSaSessionList,
 579       ChildSaSession->LocalPeerSpi,
 580       IKEV2_ESTABLISHING_CHILDSA_LIST
 581       );
 582     Ikev2ChildSaSessionReg (ChildSaSession, Private);
 583   }
 584
 585   return ;
 586
 587 ON_ERROR:
 588   if (ChildSaSession != NULL) {
 589     //
 590     // Remove the ChildSa from the list (Established list or Negotiating list).
 591     //
 592     RemoveEntryList (&ChildSaSession->ByIkeSa);
 593     Ikev2ChildSaSessionFree (ChildSaSession);
 594   }
 595
 596   if (IsNewSession && IkeSaSession != NULL) {
 597     //
 598     // Remove the IkeSa from the list (Established list or Negotiating list).
 599     //
 600     if ((&IkeSaSession->BySessionTable)->ForwardLink != NULL &&
 601         !IsListEmpty (&IkeSaSession->BySessionTable
 602        )){
 603       RemoveEntryList (&IkeSaSession->BySessionTable);
 604     }
 605     Ikev2SaSessionFree (IkeSaSession);
 606   }
 607
 608   return ;
 609 }
 610
 611 /**
 612
 613   The general interface when received a IKEv2 packet for the IKE Child SA establishing
 614   or IKE SA/CHILD SA rekeying.
 615
 616   This function first find the related IKE SA Session according to the IKE packet's
 617   remote IP. Then call the corresponding function to handle this IKE packet according
 618   to the related IKE Child Session's State.
 619
 620   @param[in] UdpService    Pointer of related UDP Service.
 621   @param[in] IkePacket     Data passed by caller.
 622
 623 **/
 624 VOID
 625 Ikev2HandleChildSa (
 626   IN IKE_UDP_SERVICE  *UdpService,
 627   IN IKE_PACKET       *IkePacket
 628   )
 629 {
 630   EFI_STATUS                       Status;
 631   IKEV2_SA_SESSION                 *IkeSaSession;
 632   IKEV2_CREATE_CHILD_REQUEST_TYPE  RequestType;
 633   IKE_PACKET                       *Reply;
 634   IPSEC_PRIVATE_DATA               *Private;
 635
 636   Private = (UdpService->IpVersion == IP_VERSION_4) ?
 637              IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :
 638              IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);
 639
 640   Reply   = NULL;
 641
 642   //
 643   // Lookup the remote ip address in the processing IKE SA session list.
 644   //
 645   IkeSaSession = Ikev2SaSessionLookup (&Private->Ikev2EstablishedList, &IkePacket->RemotePeerIp);
 646
 647   if (IkeSaSession == NULL) {
 648     //
 649     // Drop the packet if no IKE SA associated.
 650     //
 651     return ;
 652   }
 653
 654   //
 655   // Validate the IKE packet header.
 656   //
 657   if (!Ikev2ValidateHeader (IkeSaSession, IkePacket->Header)) {
 658     //
 659     // Drop the packet if invalid IKE header.
 660     //
 661     return;
 662   }
 663
 664   //
 665   // Decode all the payloads in the IKE packet.
 666   //
 667   Status = Ikev2DecodePacket (&IkeSaSession->SessionCommon, IkePacket, IkeSessionTypeIkeSa);
 668   if (EFI_ERROR (Status)) {
 669     return;
 670   }
 671
 672   //
 673   // Get the request type: CreateChildSa/RekeyChildSa/RekeyIkeSa.
 674   //
 675   RequestType = Ikev2ChildExchangeRequestType (IkePacket);
 676
 677   switch (RequestType) {
 678   case IkeRequestTypeCreateChildSa:
 679   case IkeRequestTypeRekeyChildSa:
 680   case IkeRequestTypeRekeyIkeSa:
 681     //
 682     // Parse the IKE request packet. Not support CREATE_CHILD_SA exchange yet, so
 683     // only EFI_UNSUPPORTED will be returned and that will trigger a reply with a
 684     // Notify payload of type NO_ADDITIONAL_SAS.
 685     //
 686     Status = mIkev2CreateChild.Parser ((UINT8 *) IkeSaSession, IkePacket);
 687     if (EFI_ERROR (Status)) {
 688       goto ON_REPLY;
 689     }
 690
 691   default:
 692     //
 693     // No support.
 694     //
 695     return ;
 696   }
 697
 698 ON_REPLY:
 699   //
 700   // Generate the reply packet if needed and send it out.
 701   //
 702   if (!(IkePacket->Header->Flags & IKE_HEADER_FLAGS_RESPOND)) {
 703     Reply = mIkev2CreateChild.Generator ((UINT8 *) IkeSaSession, &IkePacket->Header->MessageId);
 704     if (Reply != NULL) {
 705       Status = Ikev2SendIkePacket (UdpService, (UINT8 *) &(IkeSaSession->SessionCommon), Reply, 0);
 706       if (EFI_ERROR (Status)) {
 707         //
 708         //  Delete Reply payload.
 709         //
 710         if (Reply != NULL) {
 711           IkePacketFree (Reply);
 712         }
 713       }
 714     }
 715   }
 716   return ;
 717 }
 718
 719 /**
 720
 721   It is general interface to handle IKEv2 information Exchange.
 722
 723   @param[in] UdpService  Point to IKE UPD Service related to this information exchange.
 724   @param[in] IkePacket   The IKE packet to be parsed.
 725
 726 **/
 727 VOID
 728 Ikev2HandleInfo (
 729   IN IKE_UDP_SERVICE  *UdpService,
 730   IN IKE_PACKET       *IkePacket
 731   )
 732 {
 733   EFI_STATUS              Status;
 734   IKEV2_SESSION_COMMON    *SessionCommon;
 735   IKEV2_SA_SESSION        *IkeSaSession;
 736   IPSEC_PRIVATE_DATA      *Private;
 737
 738   Private = (UdpService->IpVersion == IP_VERSION_4) ?
 739              IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :
 740              IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);
 741
 742   //
 743   // Lookup the remote ip address in the processing IKE SA session list.
 744   //
 745   IkeSaSession = Ikev2SaSessionLookup (&Private->Ikev2EstablishedList, &IkePacket->RemotePeerIp);
 746
 747   if (IkeSaSession == NULL) {
 748     //
 749     // Drop the packet if no IKE SA associated.
 750     //
 751     return ;
 752   }
 753   //
 754   // Validate the IKE packet header.
 755   //
 756   if (!Ikev2ValidateHeader (IkeSaSession, IkePacket->Header)) {
 757
 758     //
 759     // Drop the packet if invalid IKE header.
 760     //
 761     return;
 762   }
 763
 764   SessionCommon = &IkeSaSession->SessionCommon;
 765
 766   //
 767   // Decode all the payloads in the IKE packet.
 768   //
 769   Status = Ikev2DecodePacket (SessionCommon, IkePacket, IkeSessionTypeIkeSa);
 770   if (EFI_ERROR (Status)) {
 771     return;
 772   }
 773
 774   Status = mIkev2Info.Parser ((UINT8 *)IkeSaSession, IkePacket);
 775
 776   if (EFI_ERROR (Status)) {
 777     //
 778     // Drop the packet if fail to parse.
 779     //
 780     return;
 781   }
 782 }
 783
 784 IKE_EXCHANGE_INTERFACE  mIkev1Exchange = {
 785   1,
 786   NULL, //Ikev1NegotiateSa
 787   NULL, //Ikev1NegotiateChildSa
 788   NULL,
 789   NULL, //Ikev1HandleSa,
 790   NULL, //Ikev1HandleChildSa
 791   NULL, //Ikev1HandleInfo
 792 };
 793
 794 IKE_EXCHANGE_INTERFACE  mIkev2Exchange = {
 795   2,
 796   Ikev2NegotiateSa,
 797   Ikev2NegotiateChildSa,
 798   Ikev2NegotiateInfo,
 799   Ikev2HandleSa,
 800   Ikev2HandleChildSa,
 801   Ikev2HandleInfo
 802 };
 803