NetworkPkg/IpSecDxe/Ikev2/Info.c

   1 /** @file
   2   The Implementations for Information Exchange.
   3
   4   (C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>
   5   Copyright (c) 2010, Intel Corporation. All rights reserved.<BR>
   6
   7   This program and the accompanying materials
   8   are licensed and made available under the terms and conditions of the BSD License
   9   which accompanies this distribution.  The full text of the license may be found at
  10   http://opensource.org/licenses/bsd-license.php.
  11
  12   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  13   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  14
  15 **/
  16
  17 #include "Utility.h"
  18 #include "IpSecDebug.h"
  19 #include "IpSecConfigImpl.h"
  20
  21 /**
  22   Generate Information Packet.
  23
  24   The information Packet may contain one Delete Payload, or Notify Payload, which
  25   dependes on the Context's parameters.
  26
  27   @param[in]  SaSession   Pointer to IKE SA Session or Child SA Session which is
  28                           related to the information Exchange.
  29   @param[in]  Context     The Data passed from the caller. If the Context is not NULL
  30                           it should contain the information for Notification Data.
  31
  32   @retval     Pointer of IKE_PACKET generated.
  33
  34 **/
  35 IKE_PACKET *
  36 Ikev2InfoGenerator (
  37   IN UINT8                         *SaSession,
  38   IN VOID                          *Context
  39   )
  40 {
  41   IKEV2_SA_SESSION            *IkeSaSession;
  42   IKEV2_CHILD_SA_SESSION      *ChildSaSession;
  43   IKE_PACKET                  *IkePacket;
  44   IKE_PAYLOAD                 *IkePayload;
  45   IKEV2_INFO_EXCHANGE_CONTEXT *InfoContext;
  46
  47   InfoContext  = NULL;
  48   IkeSaSession = (IKEV2_SA_SESSION *) SaSession;
  49   IkePacket    = IkePacketAlloc ();
  50   ASSERT (IkePacket != NULL);
  51
  52   //
  53   // Fill IkePacket Header.
  54   //
  55   IkePacket->Header->ExchangeType    = IKEV2_EXCHANGE_TYPE_INFO;
  56   IkePacket->Header->Version         = (UINT8) (2 << 4);
  57
  58   if (Context != NULL) {
  59     InfoContext = (IKEV2_INFO_EXCHANGE_CONTEXT *) Context;
  60   }
  61
  62   //
  63   // For Liveness Check
  64   //
  65   if (InfoContext != NULL &&
  66       (InfoContext->InfoType == Ikev2InfoLiveCheck || InfoContext->InfoType == Ikev2InfoNotify)
  67     ) {
  68     IkePacket->Header->MessageId       = InfoContext->MessageId;
  69     IkePacket->Header->InitiatorCookie = IkeSaSession->InitiatorCookie;
  70     IkePacket->Header->ResponderCookie = IkeSaSession->ResponderCookie;
  71     IkePacket->Header->NextPayload     = IKEV2_PAYLOAD_TYPE_NONE;
  72     IkePacket->Header->Flags           = IKE_HEADER_FLAGS_RESPOND;
  73     //
  74     // TODO: add Notify Payload for Notification Information.
  75     //
  76     return IkePacket;
  77   }
  78
  79   //
  80   // For delete SAs
  81   //
  82   if (IkeSaSession->SessionCommon.IkeSessionType == IkeSessionTypeIkeSa) {
  83
  84     IkePacket->Header->InitiatorCookie = IkeSaSession->InitiatorCookie;
  85     IkePacket->Header->ResponderCookie = IkeSaSession->ResponderCookie;
  86
  87     //
  88     // If the information message is response message,the MessageId should
  89     // be same as the request MessageId which passed through the Context.
  90     //
  91     if (InfoContext != NULL) {
  92       IkePacket->Header->MessageId     = InfoContext->MessageId;
  93     } else {
  94       IkePacket->Header->MessageId     = IkeSaSession->MessageId;
  95       Ikev2SaSessionIncreaseMessageId (IkeSaSession);
  96     }
  97     //
  98     // If the state is on deleting generate a Delete Payload for it.
  99     //
 100     if (IkeSaSession->SessionCommon.State == IkeStateSaDeleting ) {
 101       IkePayload = Ikev2GenerateDeletePayload (
 102                      IkeSaSession,
 103                      IKEV2_PAYLOAD_TYPE_NONE,
 104                      0,
 105                      0,
 106                      NULL
 107                      );
 108       if (IkePayload == NULL) {
 109         goto ERROR_EXIT;
 110       }
 111       //
 112       // Fill the next payload in IkePacket's Header.
 113       //
 114       IkePacket->Header->NextPayload     = IKEV2_PAYLOAD_TYPE_DELETE;
 115       IKE_PACKET_APPEND_PAYLOAD (IkePacket, IkePayload);
 116       IkePacket->Private           = IkeSaSession->SessionCommon.Private;
 117       IkePacket->Spi               = 0;
 118       IkePacket->IsDeleteInfo      = TRUE;
 119
 120     } else if (Context != NULL) {
 121       //
 122       // TODO: If contest is not NULL Generate a Notify Payload.
 123       //
 124     } else {
 125       //
 126       // The input parameter is not correct.
 127       //
 128       goto ERROR_EXIT;
 129     }
 130   } else {
 131     //
 132     // Delete the Child SA Information Exchagne
 133     //
 134     ChildSaSession                     = (IKEV2_CHILD_SA_SESSION *) SaSession;
 135     IkeSaSession                       = ChildSaSession->IkeSaSession;
 136     IkePacket->Header->InitiatorCookie = ChildSaSession->IkeSaSession->InitiatorCookie;
 137     IkePacket->Header->ResponderCookie = ChildSaSession->IkeSaSession->ResponderCookie;
 138
 139     //
 140     // If the information message is response message,the MessageId should
 141     // be same as the request MessageId which passed through the Context.
 142     //
 143     if (InfoContext != NULL && InfoContext->MessageId != 0) {
 144       IkePacket->Header->MessageId     = InfoContext->MessageId;
 145     } else {
 146       IkePacket->Header->MessageId     = ChildSaSession->IkeSaSession->MessageId;
 147       Ikev2SaSessionIncreaseMessageId (IkeSaSession);
 148     }
 149
 150     IkePayload     = Ikev2GenerateDeletePayload (
 151                        ChildSaSession->IkeSaSession,
 152                        IKEV2_PAYLOAD_TYPE_DELETE,
 153                        4,
 154                        1,
 155                        (UINT8 *)&ChildSaSession->LocalPeerSpi
 156                        );
 157     if (IkePayload == NULL) {
 158       goto ERROR_EXIT;
 159     }
 160     //
 161     // Fill the Next Payload in IkePacket's Header.
 162     //
 163     IkePacket->Header->NextPayload     = IKEV2_PAYLOAD_TYPE_DELETE;
 164     IKE_PACKET_APPEND_PAYLOAD (IkePacket, IkePayload);
 165
 166     IkePacket->Private      = IkeSaSession->SessionCommon.Private;
 167     IkePacket->Spi          = ChildSaSession->LocalPeerSpi;
 168     IkePacket->IsDeleteInfo = TRUE;
 169
 170     if (!ChildSaSession->SessionCommon.IsInitiator) {
 171       //
 172       // If responder, use the MessageId fromt the initiator.
 173       //
 174       IkePacket->Header->MessageId = ChildSaSession->MessageId;
 175     }
 176
 177     //
 178     // Change the IsOnDeleting Flag
 179     //
 180     ChildSaSession->SessionCommon.IsOnDeleting = TRUE;
 181   }
 182
 183   if (InfoContext == NULL) {
 184     IkePacket->Header->Flags = IKE_HEADER_FLAGS_INIT;
 185   } else {
 186     IkePacket->Header->Flags = IKE_HEADER_FLAGS_RESPOND;
 187   }
 188   return IkePacket;
 189
 190 ERROR_EXIT:
 191    if (IkePacket != NULL) {
 192      FreePool (IkePacket);
 193    }
 194    return NULL;
 195
 196 }
 197
 198 /**
 199   Parse the Info Exchange.
 200
 201   @param[in]  SaSession   Pointer to IKEV2_SA_SESSION.
 202   @param[in]  IkePacket   Pointer to IkePacket related to the Information Exchange.
 203
 204   @retval  EFI_SUCCESS    The operation finised successed.
 205
 206 **/
 207 EFI_STATUS
 208 Ikev2InfoParser (
 209   IN UINT8                         *SaSession,
 210   IN IKE_PACKET                    *IkePacket
 211   )
 212 {
 213   IKEV2_CHILD_SA_SESSION *ChildSaSession;
 214   IKEV2_SA_SESSION       *IkeSaSession;
 215   IKE_PAYLOAD            *DeletePayload;
 216   IKE_PAYLOAD            *IkePayload;
 217   IKEV2_DELETE           *Delete;
 218   LIST_ENTRY             *Entry;
 219   LIST_ENTRY             *ListEntry;
 220   UINT8                  Index;
 221   UINT32                 Spi;
 222   UINT8                  *SpiBuffer;
 223   IPSEC_PRIVATE_DATA     *Private;
 224   UINT8                  Value;
 225   EFI_STATUS             Status;
 226   IKE_PACKET             *RespondPacket;
 227
 228   IKEV2_INFO_EXCHANGE_CONTEXT Context;
 229
 230   IkeSaSession   = (IKEV2_SA_SESSION *) SaSession;
 231
 232   DeletePayload  = NULL;
 233   Private        = NULL;
 234   RespondPacket  = NULL;
 235   Status         = EFI_SUCCESS;
 236
 237   //
 238   // For Liveness Check
 239   //
 240   if (IkePacket->Header->NextPayload == IKEV2_PAYLOAD_TYPE_NONE &&
 241       (IkePacket->PayloadTotalSize == 0)
 242       ) {
 243     if (IkePacket->Header->Flags == IKE_HEADER_FLAGS_INIT) {
 244       //
 245       // If it is Liveness check request, reply it.
 246       //
 247       Context.InfoType  = Ikev2InfoLiveCheck;
 248       Context.MessageId = IkePacket->Header->MessageId;
 249       RespondPacket     = Ikev2InfoGenerator ((UINT8 *)IkeSaSession, &Context);
 250
 251       if (RespondPacket == NULL) {
 252         Status = EFI_INVALID_PARAMETER;
 253         return Status;
 254       }
 255       Status = Ikev2SendIkePacket (
 256                  IkeSaSession->SessionCommon.UdpService,
 257                  (UINT8 *)(&IkeSaSession->SessionCommon),
 258                  RespondPacket,
 259                  0
 260                  );
 261
 262     } else {
 263       //
 264       // Todo: verify the liveness check response packet.
 265       //
 266     }
 267     return Status;
 268   }
 269
 270   //
 271   // For SA Delete
 272   //
 273   NET_LIST_FOR_EACH (Entry, &(IkePacket)->PayloadList) {
 274
 275   //
 276   // Iterate payloads to find the Delete/Notify Payload.
 277   //
 278     IkePayload  = IKE_PAYLOAD_BY_PACKET (Entry);
 279
 280     if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_DELETE) {
 281       DeletePayload = IkePayload;
 282       Delete = (IKEV2_DELETE *)DeletePayload->PayloadBuf;
 283
 284       if (Delete->SpiSize == 0) {
 285         //
 286         // Delete IKE SA.
 287         //
 288         if (IkeSaSession->SessionCommon.State == IkeStateSaDeleting) {
 289           RemoveEntryList (&IkeSaSession->BySessionTable);
 290           Ikev2SaSessionFree (IkeSaSession);
 291           //
 292           // Checking the Private status.
 293           //
 294           //
 295           // when all IKE SAs were disabled by calling "IPsecConfig -disable", the IPsec
 296           // status should be changed.
 297           //
 298           Private = IkeSaSession->SessionCommon.Private;
 299           if (Private != NULL && Private->IsIPsecDisabling) {
 300             //
 301             // After all IKE SAs were deleted, set the IPSEC_STATUS_DISABLED value in
 302             // IPsec status variable.
 303             //
 304             if (IsListEmpty (&Private->Ikev1EstablishedList) &&
 305                 (IsListEmpty (&Private->Ikev2EstablishedList))
 306                ) {
 307               Value  = IPSEC_STATUS_DISABLED;
 308               Status = gRT->SetVariable (
 309                          IPSECCONFIG_STATUS_NAME,
 310                          &gEfiIpSecConfigProtocolGuid,
 311                          EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_NON_VOLATILE,
 312                          sizeof (Value),
 313                          &Value
 314                          );
 315               if (!EFI_ERROR (Status)) {
 316                 //
 317                 // Set the DisabledFlag in Private data.
 318                 //
 319                 Private->IpSec.DisabledFlag = TRUE;
 320                 Private->IsIPsecDisabling   = FALSE;
 321               }
 322             }
 323           }
 324         } else {
 325           IkeSaSession->SessionCommon.State = IkeStateSaDeleting;
 326           Context.InfoType                  = Ikev2InfoDelete;
 327           Context.MessageId                 = IkePacket->Header->MessageId;
 328
 329           RespondPacket = Ikev2InfoGenerator ((UINT8 *)IkeSaSession, &Context);
 330           if (RespondPacket == NULL) {
 331             Status = EFI_INVALID_PARAMETER;
 332             return Status;
 333           }
 334           Status = Ikev2SendIkePacket (
 335                      IkeSaSession->SessionCommon.UdpService,
 336                      (UINT8 *)(&IkeSaSession->SessionCommon),
 337                      RespondPacket,
 338                      0
 339                      );
 340         }
 341       } else if (Delete->SpiSize == 4) {
 342         //
 343         // Move the Child SAs to DeleteList
 344         //
 345         SpiBuffer = (UINT8 *)(Delete + 1);
 346         for (Index = 0; Index < Delete->NumSpis; Index++) {
 347           Spi = ReadUnaligned32 ((UINT32 *)SpiBuffer);
 348           for (ListEntry = IkeSaSession->ChildSaEstablishSessionList.ForwardLink;
 349                ListEntry != &IkeSaSession->ChildSaEstablishSessionList;
 350           ) {
 351             ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (ListEntry);
 352             ListEntry = ListEntry->ForwardLink;
 353
 354             if (ChildSaSession->RemotePeerSpi == HTONL(Spi)) {
 355               if (ChildSaSession->SessionCommon.State != IkeStateSaDeleting) {
 356
 357                 //
 358                 // Insert the ChildSa Session into Delete List.
 359                 //
 360                 InsertTailList (&IkeSaSession->DeleteSaList, &ChildSaSession->ByDelete);
 361                 ChildSaSession->SessionCommon.State       = IkeStateSaDeleting;
 362                 ChildSaSession->SessionCommon.IsInitiator = FALSE;
 363                 ChildSaSession->MessageId                 = IkePacket->Header->MessageId;
 364
 365                 Context.InfoType = Ikev2InfoDelete;
 366                 Context.MessageId = IkePacket->Header->MessageId;
 367
 368                 RespondPacket = Ikev2InfoGenerator ((UINT8 *)ChildSaSession, &Context);
 369                 if (RespondPacket == NULL) {
 370                   Status = EFI_INVALID_PARAMETER;
 371                   return Status;
 372                 }
 373                 Status = Ikev2SendIkePacket (
 374                            ChildSaSession->SessionCommon.UdpService,
 375                            (UINT8 *)(&ChildSaSession->SessionCommon),
 376                            RespondPacket,
 377                            0
 378                            );
 379               } else {
 380                 //
 381                 // Delete the Child SA.
 382                 //
 383                 Ikev2ChildSaSilentDelete (IkeSaSession, Spi);
 384                 RemoveEntryList (&ChildSaSession->ByDelete);
 385               }
 386             }
 387           }
 388           SpiBuffer = SpiBuffer + sizeof (Spi);
 389         }
 390       }
 391     }
 392   }
 393
 394   return Status;
 395 }
 396
 397 GLOBAL_REMOVE_IF_UNREFERENCED IKEV2_PACKET_HANDLER  mIkev2Info = {
 398   Ikev2InfoParser,
 399   Ikev2InfoGenerator
 400 };