2 The general interfaces of the IKEv2.
4 Copyright (c) 2010 - 2011, Intel Corporation. All rights reserved.<BR>
6 This program and the accompanying materials
7 are licensed and made available under the terms and conditions of the BSD License
8 which accompanies this distribution. The full text of the license may be found at
9 http://opensource.org/licenses/bsd-license.php.
11 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
12 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
17 #include "IpSecDebug.h"
18 #include "IkeService.h"
19 #include "IpSecConfigImpl.h"
22 General interface to intialize a IKEv2 negotiation.
24 @param[in] UdpService Point to Udp Servcie used for the IKE packet sending.
25 @param[in] SpdEntry Point to SPD entry related to this IKE negotiation.
26 @param[in] PadEntry Point to PAD entry related to this IKE negotiation.
27 @param[in] RemoteIp Point to IP Address which the remote peer to negnotiate.
29 @retval EFI_SUCCESS The operation is successful.
30 @retval EFI_OUT_OF_RESOURCES The required system resource can't be allocated.
31 @retval EFI_INVALID_PARAMETER If UdpService or RemoteIp is NULL.
32 @return Others The operation is failed.
37 IN IKE_UDP_SERVICE
*UdpService
,
38 IN IPSEC_SPD_ENTRY
*SpdEntry
,
39 IN IPSEC_PAD_ENTRY
*PadEntry
,
40 IN EFI_IP_ADDRESS
*RemoteIp
43 IPSEC_PRIVATE_DATA
*Private
;
44 IKEV2_SA_SESSION
*IkeSaSession
;
45 IKEV2_SESSION_COMMON
*SessionCommon
;
46 IKEV2_PACKET_HANDLER Handler
;
47 IKE_PACKET
*IkePacket
;
50 if (UdpService
== NULL
|| RemoteIp
== NULL
) {
51 return EFI_INVALID_PARAMETER
;
55 Private
= (UdpService
->IpVersion
== IP_VERSION_4
) ?
56 IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService
->ListHead
) :
57 IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService
->ListHead
);
60 // Lookup the remote ip address in the processing IKE SA session list.
62 IkeSaSession
= Ikev2SaSessionLookup (&Private
->Ikev2SessionList
, RemoteIp
);
63 if (IkeSaSession
!= NULL
) {
65 // Drop the packet if already in process.
71 // Create a new IkeSaSession and initiate the common parameters.
73 IkeSaSession
= Ikev2SaSessionAlloc (Private
, UdpService
);
74 if (IkeSaSession
== NULL
) {
75 return EFI_OUT_OF_RESOURCES
;
79 // Set the specific parameters and state(IKE_STATE_INIT).
81 IkeSaSession
->Spd
= SpdEntry
;
82 IkeSaSession
->Pad
= PadEntry
;
83 SessionCommon
= &IkeSaSession
->SessionCommon
;
84 SessionCommon
->IsInitiator
= TRUE
;
85 SessionCommon
->State
= IkeStateInit
;
87 // TODO: Get the prefer DH Group from the IPsec Configuration, after the IPsecconfig application update
90 SessionCommon
->PreferDhGroup
= IKEV2_TRANSFORM_ID_DH_1024MODP
;
93 &SessionCommon
->RemotePeerIp
,
95 sizeof (EFI_IP_ADDRESS
)
99 &SessionCommon
->LocalPeerIp
,
100 &UdpService
->DefaultAddress
,
101 sizeof (EFI_IP_ADDRESS
)
104 IKEV2_DUMP_STATE (SessionCommon
->State
, IkeStateInit
);
107 // Initiate the SAD data of the IkeSaSession.
109 IkeSaSession
->SaData
= Ikev2InitializeSaData (SessionCommon
);
110 if (IkeSaSession
->SaData
== NULL
) {
111 Status
= EFI_OUT_OF_RESOURCES
;
116 // Generate an IKE request packet and send it out.
118 Handler
= mIkev2Initial
[IkeSaSession
->Pad
->Data
->AuthMethod
][SessionCommon
->State
];
119 IkePacket
= Handler
.Generator ((UINT8
*) IkeSaSession
, NULL
);
120 if (IkePacket
== NULL
) {
121 Status
= EFI_OUT_OF_RESOURCES
;
125 Status
= Ikev2SendIkePacket (UdpService
, (UINT8
*) SessionCommon
, IkePacket
, 0);
127 if (EFI_ERROR (Status
)) {
132 // Insert the current IkeSaSession into the processing IKE SA list.
134 Ikev2SaSessionInsert (&Private
->Ikev2SessionList
, IkeSaSession
, RemoteIp
);
140 if (IkePacket
!= NULL
) {
141 IkePacketFree (IkePacket
);
143 Ikev2SaSessionFree (IkeSaSession
);
148 It is general interface to negotiate the Child SA.
150 There are three situations which will invoke this function. First, create a CHILD
151 SA if the input Context is NULL. Second, rekeying the existing IKE SA if the Context
152 is a IKEv2_SA_SESSION. Third, rekeying the existing CHILD SA if the context is a
153 IKEv2_CHILD_SA_SESSION.
155 @param[in] IkeSaSession Pointer to IKEv2_SA_SESSION related to this operation.
156 @param[in] SpdEntry Pointer to IPSEC_SPD_ENTRY related to this operation.
157 @param[in] Context The data pass from the caller.
159 @retval EFI_SUCCESS The operation is successful.
160 @retval EFI_OUT_OF_RESOURCES The required system resource can't be allocated.
161 @retval EFI_UNSUPPORTED The condition is not support yet.
162 @return Others The operation is failed.
166 Ikev2NegotiateChildSa (
167 IN UINT8
*IkeSaSession
,
168 IN IPSEC_SPD_ENTRY
*SpdEntry
,
173 IKEV2_SA_SESSION
*SaSession
;
174 IKEV2_CHILD_SA_SESSION
*ChildSaSession
;
175 IKEV2_SESSION_COMMON
*ChildSaCommon
;
176 IKE_PACKET
*IkePacket
;
177 IKE_UDP_SERVICE
*UdpService
;
179 SaSession
= (IKEV2_SA_SESSION
*) IkeSaSession
;
180 UdpService
= SaSession
->SessionCommon
.UdpService
;
184 // 1. Create another child SA session if context is null.
185 // 2. Rekeying the IKE SA session if the context is IKE SA session.
186 // 3. Rekeying the child SA session if the context is child SA session.
188 if (Context
== NULL
) {
190 // Create a new ChildSaSession and initiate the common parameters.
192 ChildSaSession
= Ikev2ChildSaSessionAlloc (UdpService
, SaSession
);
194 if (ChildSaSession
== NULL
) {
195 return EFI_OUT_OF_RESOURCES
;
199 // Set the specific parameters and state as IKE_STATE_CREATE_CHILD.
201 ChildSaSession
->Spd
= SpdEntry
;
202 ChildSaCommon
= &ChildSaSession
->SessionCommon
;
203 ChildSaCommon
->IsInitiator
= TRUE
;
204 ChildSaCommon
->State
= IkeStateCreateChild
;
206 IKEV2_DUMP_STATE (ChildSaCommon
->State
, IkeStateCreateChild
);
208 if (SpdEntry
->Selector
->NextLayerProtocol
!= EFI_IPSEC_ANY_PROTOCOL
) {
209 ChildSaSession
->ProtoId
= SpdEntry
->Selector
->NextLayerProtocol
;
212 if (SpdEntry
->Selector
->LocalPort
!= EFI_IPSEC_ANY_PORT
) {
213 ChildSaSession
->LocalPort
= SpdEntry
->Selector
->LocalPort
;
216 if (SpdEntry
->Selector
->RemotePort
!= EFI_IPSEC_ANY_PORT
) {
217 ChildSaSession
->RemotePort
= SpdEntry
->Selector
->RemotePort
;
220 // Initiate the SAD data parameters of the ChildSaSession.
222 ChildSaSession
->SaData
= Ikev2InitializeSaData (ChildSaCommon
);
223 if (ChildSaSession
->SaData
== NULL
) {
224 Status
= EFI_OUT_OF_RESOURCES
;
228 // Generate an IKE request packet and send it out.
230 IkePacket
= mIkev2CreateChild
.Generator ((UINT8
*) ChildSaSession
, NULL
);
232 if (IkePacket
== NULL
) {
233 Status
= EFI_OUT_OF_RESOURCES
;
237 Status
= Ikev2SendIkePacket (UdpService
, (UINT8
*) ChildSaCommon
, IkePacket
, 0);
239 if (EFI_ERROR (Status
)) {
244 // Insert the ChildSaSession into processing child SA list.
246 Ikev2ChildSaSessionInsert (&SaSession
->ChildSaSessionList
, ChildSaSession
);
249 // TODO: Rekeying IkeSaSession or ChildSaSession, NOT support yet.
251 // Rekey IkeSa, set IkeSaSession->State and pass over IkeSaSession
252 // Rekey ChildSa, set ChildSaSession->State and pass over ChildSaSession
254 return EFI_UNSUPPORTED
;
261 if (ChildSaSession
->SaData
!= NULL
) {
262 FreePool (ChildSaSession
->SaData
);
265 if (ChildSaSession
->SessionCommon
.TimeoutEvent
!= NULL
) {
266 gBS
->CloseEvent (ChildSaSession
->SessionCommon
.TimeoutEvent
);
269 if (IkePacket
!= NULL
) {
270 IkePacketFree (IkePacket
);
273 Ikev2ChildSaSessionFree (ChildSaSession
);
278 It is general interface to start the Information Exchange.
280 There are three situations which will invoke this function. First, deliver a Delete Information
281 to delete the IKE SA if the input Context is NULL and the state of related IkeSaSeesion's is on
282 deleting.Second, deliver a Notify Information without the contents if the input Context is NULL.
283 Third, deliver a Notify Information if the input Context is not NULL.
285 @param[in] IkeSaSession Pointer to IKEv2_SA_SESSION related to this operation.
286 @param[in] Context Data passed by caller.
288 @retval EFI_SUCCESS The operation is successful.
289 @retval EFI_OUT_OF_RESOURCES The required system resource can't be allocated.
290 @retval EFI_UNSUPPORTED The condition is not support yet.
291 @return Otherwise The operation is failed.
296 IN UINT8
*IkeSaSession
,
302 IKEV2_SA_SESSION
*Ikev2SaSession
;
303 IKEV2_CHILD_SA_SESSION
*ChildSaSession
;
304 IKEV2_SESSION_COMMON
*SaCommon
;
305 IKE_PACKET
*IkePacket
;
306 IKE_UDP_SERVICE
*UdpService
;
308 LIST_ENTRY
*NextEntry
;
310 Ikev2SaSession
= (IKEV2_SA_SESSION
*) IkeSaSession
;
311 UdpService
= Ikev2SaSession
->SessionCommon
.UdpService
;
312 SaCommon
= &Ikev2SaSession
->SessionCommon
;
314 Status
= EFI_SUCCESS
;
317 // Delete the IKE SA.
319 if (Ikev2SaSession
->SessionCommon
.State
== IkeStateSaDeleting
&& Context
== NULL
) {
322 // Generate Information Packet which contains the Delete Payload.
324 IkePacket
= mIkev2Info
.Generator ((UINT8
*) Ikev2SaSession
, NULL
);
325 if (IkePacket
== NULL
) {
326 Status
= EFI_OUT_OF_RESOURCES
;
331 // Send out the Packet
333 if (UdpService
!= NULL
) {
334 Status
= Ikev2SendIkePacket (UdpService
, (UINT8
*) SaCommon
, IkePacket
, 0);
336 if (EFI_ERROR (Status
)) {
340 } else if (!IsListEmpty (&Ikev2SaSession
->DeleteSaList
)) {
342 // Iterate all Deleting Child SAs.
344 NET_LIST_FOR_EACH_SAFE (Entry
, NextEntry
, &Ikev2SaSession
->DeleteSaList
) {
345 ChildSaSession
= IKEV2_CHILD_SA_SESSION_BY_DEL_SA (Entry
);
346 ChildSaSession
->SessionCommon
.State
= IkeStateSaDeleting
;
349 // Generate Information Packet which contains the Child SA Delete Payload.
351 IkePacket
= mIkev2Info
.Generator ((UINT8
*) ChildSaSession
, NULL
);
352 if (IkePacket
== NULL
) {
353 Status
= EFI_OUT_OF_RESOURCES
;
358 // Send out the Packet
360 if (UdpService
!= NULL
) {
361 Status
= Ikev2SendIkePacket (UdpService
, (UINT8
*) &ChildSaSession
->SessionCommon
, IkePacket
, 0);
363 if (EFI_ERROR (Status
)) {
368 } else if (Context
== NULL
) {
370 // TODO: Deliver null notification message.
372 } else if (Context
!= NULL
) {
374 // TODO: Send out the Information Exchange which contains the Notify Payload.
378 if (IkePacket
!= NULL
) {
379 IkePacketFree (IkePacket
);
386 The general interface when received a IKEv2 packet for the IKE SA establishing.
388 This function first find the related IKE SA Session according to the IKE packet's
389 remote IP. Then call the corresponding function to handle this IKE packet according
390 to the related IKE SA Session's State.
392 @param[in] UdpService Pointer of related UDP Service.
393 @param[in] IkePacket Data passed by caller.
398 IN IKE_UDP_SERVICE
*UdpService
,
399 IN IKE_PACKET
*IkePacket
403 IKEV2_SA_SESSION
*IkeSaSession
;
404 IKEV2_CHILD_SA_SESSION
*ChildSaSession
;
405 IKEV2_SESSION_COMMON
*IkeSaCommon
;
406 IKEV2_SESSION_COMMON
*ChildSaCommon
;
407 IKEV2_PACKET_HANDLER Handler
;
409 IPSEC_PAD_ENTRY
*PadEntry
;
410 IPSEC_PRIVATE_DATA
*Private
;
411 BOOLEAN IsNewSession
;
413 Private
= (UdpService
->IpVersion
== IP_VERSION_4
) ?
414 IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService
->ListHead
) :
415 IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService
->ListHead
);
417 ChildSaSession
= NULL
;
418 ChildSaCommon
= NULL
;
421 // Lookup the remote ip address in the processing IKE SA session list.
423 IkeSaSession
= Ikev2SaSessionLookup (&Private
->Ikev2SessionList
, &IkePacket
->RemotePeerIp
);
424 IsNewSession
= FALSE
;
426 if (IkeSaSession
== NULL
) {
428 // Lookup the remote ip address in the pad.
430 PadEntry
= IpSecLookupPadEntry (UdpService
->IpVersion
, &IkePacket
->RemotePeerIp
);
431 if (PadEntry
== NULL
) {
433 // Drop the packet if no pad entry matched, this is the request from RFC 4301.
439 // Create a new IkeSaSession and initiate the common parameters.
441 IkeSaSession
= Ikev2SaSessionAlloc (Private
, UdpService
);
442 if (IkeSaSession
== NULL
) {
445 IkeSaSession
->Pad
= PadEntry
;
446 IkeSaCommon
= &IkeSaSession
->SessionCommon
;
447 IkeSaCommon
->IsInitiator
= FALSE
;
448 IkeSaCommon
->State
= IkeStateInit
;
450 IKEV2_DUMP_STATE (IkeSaCommon
->State
, IkeStateInit
);
453 &IkeSaCommon
->RemotePeerIp
,
454 &IkePacket
->RemotePeerIp
,
455 sizeof (EFI_IP_ADDRESS
)
459 &IkeSaCommon
->LocalPeerIp
,
460 &UdpService
->DefaultAddress
,
461 sizeof (EFI_IP_ADDRESS
)
468 // Validate the IKE packet header.
470 Status
= Ikev2ValidateHeader (IkeSaSession
, IkePacket
->Header
);
471 if (EFI_ERROR (Status
)) {
473 // Drop the packet if invalid IKE header.
479 // Decode all the payloads in the IKE packet.
481 IkeSaCommon
= &IkeSaSession
->SessionCommon
;
482 Status
= Ikev2DecodePacket (IkeSaCommon
, IkePacket
, IkeSessionTypeIkeSa
);
483 if (EFI_ERROR (Status
)) {
488 // Try to reate the first ChildSa Session of that IkeSaSession.
489 // If the IkeSaSession is responder, here will create the first ChildSaSession.
491 if (IkeSaCommon
->State
== IkeStateAuth
&& IsListEmpty(&IkeSaSession
->ChildSaSessionList
)) {
493 // Generate a piggyback child SA in IKE_STATE_AUTH state.
495 ASSERT (IsListEmpty (&IkeSaSession
->ChildSaSessionList
) &&
496 IsListEmpty (&IkeSaSession
->ChildSaEstablishSessionList
));
498 ChildSaSession
= Ikev2ChildSaSessionCreate (IkeSaSession
, UdpService
);
499 ChildSaCommon
= &ChildSaSession
->SessionCommon
;
503 // Parse the IKE request packet according to the auth method and current state.
505 Handler
= mIkev2Initial
[IkeSaSession
->Pad
->Data
->AuthMethod
][IkeSaCommon
->State
];
506 Status
= Handler
.Parser ((UINT8
*)IkeSaSession
, IkePacket
);
507 if (EFI_ERROR (Status
)) {
512 // Try to reate the first ChildSa Session of that IkeSaSession.
513 // If the IkeSaSession is initiator, here will create the first ChildSaSession.
515 if (IkeSaCommon
->State
== IkeStateAuth
&& IsListEmpty(&IkeSaSession
->ChildSaSessionList
)) {
517 // Generate a piggyback child SA in IKE_STATE_AUTH state.
519 ASSERT (IsListEmpty (&IkeSaSession
->ChildSaSessionList
) &&
520 IsListEmpty (&IkeSaSession
->ChildSaEstablishSessionList
));
522 ChildSaSession
= Ikev2ChildSaSessionCreate (IkeSaSession
, UdpService
);
523 ChildSaCommon
= &ChildSaSession
->SessionCommon
;
526 // Initialize the SA data for Child SA.
528 ChildSaSession
->SaData
= Ikev2InitializeSaData (ChildSaCommon
);
532 // Generate the IKE response packet and send it out if not established.
534 if (IkeSaCommon
->State
!= IkeStateIkeSaEstablished
) {
535 Handler
= mIkev2Initial
[IkeSaSession
->Pad
->Data
->AuthMethod
][IkeSaCommon
->State
];
536 Reply
= Handler
.Generator ((UINT8
*) IkeSaSession
, NULL
);
541 Status
= Ikev2SendIkePacket (UdpService
, (UINT8
*) IkeSaCommon
, Reply
, 0);
542 if (EFI_ERROR (Status
)) {
545 if (!IkeSaCommon
->IsInitiator
) {
546 IkeSaCommon
->State
++;
547 IKEV2_DUMP_STATE (IkeSaCommon
->State
- 1, IkeSaCommon
->State
);
552 // Insert the new IkeSaSession into the Private processing IkeSaSession List.
555 Ikev2SaSessionInsert (&Private
->Ikev2SessionList
, IkeSaSession
, &IkePacket
->RemotePeerIp
);
559 // Register the IkeSaSession and remove it from processing list.
561 if (IkeSaCommon
->State
== IkeStateIkeSaEstablished
) {
564 // Remove the Established IKE SA Session from the IKE SA Session Negotiating list
565 // and insert it into IKE SA Session Established list.
567 Ikev2SaSessionRemove (&Private
->Ikev2SessionList
, &IkePacket
->RemotePeerIp
);
568 Ikev2SaSessionReg (IkeSaSession
, Private
);
571 // Remove the Established Child SA Session from the IkeSaSession->ChildSaSessionList
572 // ,insert it into IkeSaSession->ChildSaEstablishSessionList and save this Child SA
575 ChildSaSession
= IKEV2_CHILD_SA_SESSION_BY_IKE_SA (IkeSaSession
->ChildSaSessionList
.BackLink
);
576 Ikev2ChildSaSessionRemove (
577 &IkeSaSession
->ChildSaSessionList
,
578 ChildSaSession
->LocalPeerSpi
,
579 IKEV2_ESTABLISHING_CHILDSA_LIST
581 Ikev2ChildSaSessionReg (ChildSaSession
, Private
);
587 if (ChildSaSession
!= NULL
) {
589 // Remove the ChildSa from the list (Established list or Negotiating list).
591 RemoveEntryList (&ChildSaSession
->ByIkeSa
);
592 Ikev2ChildSaSessionFree (ChildSaSession
);
595 if (IsNewSession
&& IkeSaSession
!= NULL
) {
597 // Remove the IkeSa from the list (Established list or Negotiating list).
599 if ((&IkeSaSession
->BySessionTable
)->ForwardLink
!= NULL
&&
600 !IsListEmpty (&IkeSaSession
->BySessionTable
602 RemoveEntryList (&IkeSaSession
->BySessionTable
);
604 Ikev2SaSessionFree (IkeSaSession
);
612 The general interface when received a IKEv2 packet for the IKE Child SA establishing
613 or IKE SA/CHILD SA rekeying.
615 This function first find the related IKE SA Session according to the IKE packet's
616 remote IP. Then call the corresponding function to handle this IKE packet according
617 to the related IKE Child Session's State.
619 @param[in] UdpService Pointer of related UDP Service.
620 @param[in] IkePacket Data passed by caller.
625 IN IKE_UDP_SERVICE
*UdpService
,
626 IN IKE_PACKET
*IkePacket
630 IKEV2_SA_SESSION
*IkeSaSession
;
631 IKEV2_CREATE_CHILD_REQUEST_TYPE RequestType
;
633 IPSEC_PRIVATE_DATA
*Private
;
635 Private
= (UdpService
->IpVersion
== IP_VERSION_4
) ?
636 IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService
->ListHead
) :
637 IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService
->ListHead
);
642 // Lookup the remote ip address in the processing IKE SA session list.
644 IkeSaSession
= Ikev2SaSessionLookup (&Private
->Ikev2EstablishedList
, &IkePacket
->RemotePeerIp
);
646 if (IkeSaSession
== NULL
) {
648 // Drop the packet if no IKE SA associated.
654 // Validate the IKE packet header.
656 if (!Ikev2ValidateHeader (IkeSaSession
, IkePacket
->Header
)) {
658 // Drop the packet if invalid IKE header.
664 // Decode all the payloads in the IKE packet.
666 Status
= Ikev2DecodePacket (&IkeSaSession
->SessionCommon
, IkePacket
, IkeSessionTypeIkeSa
);
667 if (EFI_ERROR (Status
)) {
672 // Get the request type: CreateChildSa/RekeyChildSa/RekeyIkeSa.
674 RequestType
= Ikev2ChildExchangeRequestType (IkePacket
);
676 switch (RequestType
) {
677 case IkeRequestTypeCreateChildSa
:
678 case IkeRequestTypeRekeyChildSa
:
679 case IkeRequestTypeRekeyIkeSa
:
681 // Parse the IKE request packet. Not support CREATE_CHILD_SA exchange yet, so
682 // only EFI_UNSUPPORTED will be returned and that will trigger a reply with a
683 // Notify payload of type NO_ADDITIONAL_SAS.
685 Status
= mIkev2CreateChild
.Parser ((UINT8
*) IkeSaSession
, IkePacket
);
686 if (EFI_ERROR (Status
)) {
699 // Generate the reply packet if needed and send it out.
701 if (IkePacket
->Header
->Flags
!= IKE_HEADER_FLAGS_RESPOND
) {
702 Reply
= mIkev2CreateChild
.Generator ((UINT8
*) IkeSaSession
, &IkePacket
->Header
->MessageId
);
704 Status
= Ikev2SendIkePacket (UdpService
, (UINT8
*) &(IkeSaSession
->SessionCommon
), Reply
, 0);
705 if (EFI_ERROR (Status
)) {
707 // Delete Reply payload.
710 IkePacketFree (Reply
);
720 It is general interface to handle IKEv2 information Exchange.
722 @param[in] UdpService Point to IKE UPD Service related to this information exchange.
723 @param[in] IkePacket The IKE packet to be parsed.
728 IN IKE_UDP_SERVICE
*UdpService
,
729 IN IKE_PACKET
*IkePacket
733 IKEV2_SESSION_COMMON
*SessionCommon
;
734 IKEV2_SA_SESSION
*IkeSaSession
;
735 IPSEC_PRIVATE_DATA
*Private
;
737 Private
= (UdpService
->IpVersion
== IP_VERSION_4
) ?
738 IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService
->ListHead
) :
739 IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService
->ListHead
);
742 // Lookup the remote ip address in the processing IKE SA session list.
744 IkeSaSession
= Ikev2SaSessionLookup (&Private
->Ikev2EstablishedList
, &IkePacket
->RemotePeerIp
);
746 if (IkeSaSession
== NULL
) {
748 // Drop the packet if no IKE SA associated.
753 // Validate the IKE packet header.
755 if (!Ikev2ValidateHeader (IkeSaSession
, IkePacket
->Header
)) {
758 // Drop the packet if invalid IKE header.
763 SessionCommon
= &IkeSaSession
->SessionCommon
;
766 // Decode all the payloads in the IKE packet.
768 Status
= Ikev2DecodePacket (SessionCommon
, IkePacket
, IkeSessionTypeIkeSa
);
769 if (EFI_ERROR (Status
)) {
773 Status
= mIkev2Info
.Parser ((UINT8
*)IkeSaSession
, IkePacket
);
775 if (EFI_ERROR (Status
)) {
777 // Drop the packet if fail to parse.
783 IKE_EXCHANGE_INTERFACE mIkev1Exchange
= {
785 NULL
, //Ikev1NegotiateSa
786 NULL
, //Ikev1NegotiateChildSa
788 NULL
, //Ikev1HandleSa,
789 NULL
, //Ikev1HandleChildSa
790 NULL
, //Ikev1HandleInfo
793 IKE_EXCHANGE_INTERFACE mIkev2Exchange
= {
796 Ikev2NegotiateChildSa
,