NetworkPkg/IpSecDxe/Ikev2/Utility.c

   1 /** @file
   2   The Common operations used by IKE Exchange Process.
   3
   4   (C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>
   5   Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>
   6
   7   This program and the accompanying materials
   8   are licensed and made available under the terms and conditions of the BSD License
   9   which accompanies this distribution.  The full text of the license may be found at
  10   http://opensource.org/licenses/bsd-license.php.
  11
  12   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  13   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  14
  15 **/
  16
  17 #include "Utility.h"
  18 #include "IpSecDebug.h"
  19 #include "IkeService.h"
  20 #include "IpSecConfigImpl.h"
  21
  22 UINT16 mIkev2EncryptAlgorithmList[IKEV2_SUPPORT_ENCRYPT_ALGORITHM_NUM] = {
  23   IKEV2_TRANSFORM_ID_ENCR_3DES,
  24   IKEV2_TRANSFORM_ID_ENCR_AES_CBC,
  25 };
  26
  27 UINT16 mIkev2PrfAlgorithmList[IKEV2_SUPPORT_PRF_ALGORITHM_NUM] = {
  28   IKEV2_TRANSFORM_ID_PRF_HMAC_SHA1,
  29 };
  30
  31 UINT16 mIkev2DhGroupAlgorithmList[IKEV2_SUPPORT_DH_ALGORITHM_NUM] = {
  32   IKEV2_TRANSFORM_ID_DH_1024MODP,
  33   IKEV2_TRANSFORM_ID_DH_2048MODP,
  34 };
  35
  36 UINT16 mIkev2AuthAlgorithmList[IKEV2_SUPPORT_AUTH_ALGORITHM_NUM] = {
  37   IKEV2_TRANSFORM_ID_AUTH_HMAC_SHA1_96,
  38 };
  39
  40 /**
  41   Allocate buffer for IKEV2_SA_SESSION and initialize it.
  42
  43   @param[in] Private        Pointer to IPSEC_PRIVATE_DATA.
  44   @param[in] UdpService     Pointer to IKE_UDP_SERVICE related to this IKE SA Session.
  45
  46   @return Pointer to IKEV2_SA_SESSION or NULL.
  47
  48 **/
  49 IKEV2_SA_SESSION *
  50 Ikev2SaSessionAlloc (
  51   IN IPSEC_PRIVATE_DATA       *Private,
  52   IN IKE_UDP_SERVICE          *UdpService
  53   )
  54 {
  55   EFI_STATUS            Status;
  56   IKEV2_SESSION_COMMON  *SessionCommon;
  57   IKEV2_SA_SESSION      *IkeSaSession;
  58
  59   IkeSaSession = AllocateZeroPool (sizeof (IKEV2_SA_SESSION));
  60   ASSERT (IkeSaSession != NULL);
  61
  62   //
  63   // Initialize the fields of IkeSaSession and its SessionCommon.
  64   //
  65   IkeSaSession->NCookie              = NULL;
  66   IkeSaSession->Signature            = IKEV2_SA_SESSION_SIGNATURE;
  67   IkeSaSession->InitiatorCookie      = IkeGenerateCookie ();
  68   IkeSaSession->ResponderCookie      = 0;
  69   //
  70   // BUGBUG: Message ID starts from 2 is to match the OpenSwan requirement, but it
  71   // might not match the IPv6 Logo. In its test specification, it mentions that
  72   // the Message ID should start from zero after the IKE_SA_INIT exchange.
  73   //
  74   IkeSaSession->MessageId            = 2;
  75   SessionCommon                      = &IkeSaSession->SessionCommon;
  76   SessionCommon->UdpService          = UdpService;
  77   SessionCommon->Private             = Private;
  78   SessionCommon->IkeSessionType      = IkeSessionTypeIkeSa;
  79   SessionCommon->IkeVer              = 2;
  80   SessionCommon->AfterEncodePayload  = NULL;
  81   SessionCommon->BeforeDecodePayload = NULL;
  82
  83   //
  84   // Create a resend notfiy event for retry.
  85   //
  86   Status = gBS->CreateEvent (
  87                   EVT_TIMER | EVT_NOTIFY_SIGNAL,
  88                   TPL_CALLBACK,
  89                   Ikev2ResendNotify,
  90                   SessionCommon,
  91                   &SessionCommon->TimeoutEvent
  92                   );
  93
  94   if (EFI_ERROR (Status)) {
  95     FreePool (IkeSaSession);
  96     return NULL;
  97   }
  98
  99   //
 100   // Initialize the lists in IkeSaSession.
 101   //
 102   InitializeListHead (&IkeSaSession->ChildSaSessionList);
 103   InitializeListHead (&IkeSaSession->ChildSaEstablishSessionList);
 104   InitializeListHead (&IkeSaSession->InfoMIDList);
 105   InitializeListHead (&IkeSaSession->DeleteSaList);
 106
 107   return IkeSaSession;
 108 }
 109
 110 /**
 111   Register the established IKEv2 SA into Private->Ikev2EstablishedList. If there is
 112   IKEV2_SA_SESSION with same remote peer IP, remove the old one then register the
 113   new one.
 114
 115   @param[in]  IkeSaSession  Pointer to IKEV2_SA_SESSION to be registered.
 116   @param[in]  Private       Pointer to IPSEC_PRAVATE_DATA.
 117
 118 **/
 119 VOID
 120 Ikev2SaSessionReg (
 121   IN IKEV2_SA_SESSION          *IkeSaSession,
 122   IN IPSEC_PRIVATE_DATA        *Private
 123   )
 124 {
 125   IKEV2_SESSION_COMMON         *SessionCommon;
 126   IKEV2_SA_SESSION             *OldIkeSaSession;
 127   EFI_STATUS                   Status;
 128   UINT64                       Lifetime;
 129
 130   //
 131   // Keep IKE SA exclusive to remote ip address.
 132   //
 133   SessionCommon   = &IkeSaSession->SessionCommon;
 134   OldIkeSaSession = Ikev2SaSessionRemove (&Private->Ikev2EstablishedList, &SessionCommon->RemotePeerIp);
 135   if (OldIkeSaSession != NULL) {
 136     //
 137     // TODO: It should delete all child SAs if rekey the IKE SA.
 138     //
 139     Ikev2SaSessionFree (OldIkeSaSession);
 140   }
 141
 142   //
 143   // Cleanup the fields of SessionCommon for processing.
 144   //
 145   Ikev2SessionCommonRefresh (SessionCommon);
 146
 147   //
 148   // Insert the ready IKE SA session into established list.
 149   //
 150   Ikev2SaSessionInsert (&Private->Ikev2EstablishedList, IkeSaSession, &SessionCommon->RemotePeerIp);
 151
 152   //
 153   // Create a notfiy event for the IKE SA life time counting.
 154   //
 155   Status = gBS->CreateEvent (
 156                   EVT_TIMER | EVT_NOTIFY_SIGNAL,
 157                   TPL_CALLBACK,
 158                   Ikev2LifetimeNotify,
 159                   SessionCommon,
 160                   &SessionCommon->TimeoutEvent
 161                   );
 162   if (EFI_ERROR(Status)){
 163     //
 164     // If TimerEvent creation failed, the SA will be alive untill user disable it or
 165     // receiving a Delete Payload from peer.
 166     //
 167     return;
 168   }
 169
 170   //
 171   // Start to count the lifetime of the IKE SA.
 172   //
 173   if (IkeSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime == 0) {
 174     Lifetime = IKE_SA_DEFAULT_LIFETIME;
 175   } else {
 176     Lifetime = IkeSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime;
 177   }
 178
 179   Status = gBS->SetTimer (
 180                   SessionCommon->TimeoutEvent,
 181                   TimerRelative,
 182                   MultU64x32(Lifetime, 10000000) // ms->100ns
 183                   );
 184   if (EFI_ERROR(Status)){
 185     //
 186     // If SetTimer failed, the SA will be alive untill user disable it or
 187     // receiving a Delete Payload from peer.
 188     //
 189     return ;
 190   }
 191
 192   DEBUG ((
 193     DEBUG_INFO,
 194     "\n------IkeSa established and start to count down %d seconds lifetime\n",
 195     Lifetime
 196     ));
 197
 198   return ;
 199 }
 200
 201 /**
 202   Find a IKEV2_SA_SESSION by the remote peer IP.
 203
 204   @param[in]  SaSessionList     SaSession List to be searched.
 205   @param[in]  RemotePeerIp      Pointer to specified IP address.
 206
 207   @return Pointer to IKEV2_SA_SESSION if find one or NULL.
 208
 209 **/
 210 IKEV2_SA_SESSION *
 211 Ikev2SaSessionLookup (
 212   IN LIST_ENTRY           *SaSessionList,
 213   IN EFI_IP_ADDRESS       *RemotePeerIp
 214   )
 215 {
 216   LIST_ENTRY        *Entry;
 217   IKEV2_SA_SESSION  *IkeSaSession;
 218
 219   NET_LIST_FOR_EACH (Entry, SaSessionList) {
 220     IkeSaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);
 221
 222     if (CompareMem (
 223           &IkeSaSession->SessionCommon.RemotePeerIp,
 224           RemotePeerIp,
 225           sizeof (EFI_IP_ADDRESS)
 226           ) == 0) {
 227
 228       return IkeSaSession;
 229     }
 230   }
 231
 232   return NULL;
 233 }
 234
 235 /**
 236   Insert a IKE_SA_SESSION into IkeSaSession list. The IkeSaSession list is either
 237   Private->Ikev2SaSession list or Private->Ikev2EstablishedList list.
 238
 239   @param[in]  SaSessionList   Pointer to list to be inserted into.
 240   @param[in]  IkeSaSession    Pointer to IKEV2_SA_SESSION to be inserted.
 241   @param[in]  RemotePeerIp    Pointer to EFI_IP_ADDRESSS to indicate the
 242                               unique IKEV2_SA_SESSION.
 243
 244 **/
 245 VOID
 246 Ikev2SaSessionInsert (
 247   IN LIST_ENTRY           *SaSessionList,
 248   IN IKEV2_SA_SESSION     *IkeSaSession,
 249   IN EFI_IP_ADDRESS       *RemotePeerIp
 250   )
 251 {
 252   Ikev2SaSessionRemove (SaSessionList, RemotePeerIp);
 253   InsertTailList (SaSessionList, &IkeSaSession->BySessionTable);
 254 }
 255
 256 /**
 257   Remove the SA Session by Remote Peer IP.
 258
 259   @param[in]  SaSessionList   Pointer to list to be searched.
 260   @param[in]  RemotePeerIp    Pointer to EFI_IP_ADDRESS to use for SA Session search.
 261
 262   @retval Pointer to IKEV2_SA_SESSION with the specified remote IP address or NULL.
 263
 264 **/
 265 IKEV2_SA_SESSION *
 266 Ikev2SaSessionRemove (
 267   IN LIST_ENTRY           *SaSessionList,
 268   IN EFI_IP_ADDRESS       *RemotePeerIp
 269   )
 270 {
 271   LIST_ENTRY        *Entry;
 272   IKEV2_SA_SESSION  *IkeSaSession;
 273
 274   NET_LIST_FOR_EACH (Entry, SaSessionList) {
 275     IkeSaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);
 276
 277     if (CompareMem (
 278           &IkeSaSession->SessionCommon.RemotePeerIp,
 279           RemotePeerIp,
 280           sizeof (EFI_IP_ADDRESS)
 281           ) == 0) {
 282
 283       RemoveEntryList (Entry);
 284       return IkeSaSession;
 285     }
 286   }
 287
 288   return NULL;
 289 }
 290
 291 /**
 292   Marking a SA session as on deleting.
 293
 294   @param[in]  IkeSaSession  Pointer to IKEV2_SA_SESSION.
 295
 296   @retval     EFI_SUCCESS   Find the related SA session and marked it.
 297
 298 **/
 299 EFI_STATUS
 300 Ikev2SaSessionOnDeleting (
 301   IN IKEV2_SA_SESSION          *IkeSaSession
 302   )
 303 {
 304   return EFI_SUCCESS;
 305 }
 306
 307 /**
 308   Free specified Seession Common. The session common would belong to a IKE SA or
 309   a Child SA.
 310
 311   @param[in]   SessionCommon   Pointer to a Session Common.
 312
 313 **/
 314 VOID
 315 Ikev2SaSessionCommonFree (
 316   IN IKEV2_SESSION_COMMON      *SessionCommon
 317   )
 318 {
 319
 320   ASSERT (SessionCommon != NULL);
 321
 322   if (SessionCommon->LastSentPacket != NULL) {
 323     IkePacketFree (SessionCommon->LastSentPacket);
 324   }
 325
 326   if (SessionCommon->SaParams != NULL) {
 327     FreePool (SessionCommon->SaParams);
 328   }
 329   if (SessionCommon->TimeoutEvent != NULL) {
 330     gBS->CloseEvent (SessionCommon->TimeoutEvent);
 331   }
 332 }
 333
 334 /**
 335   After IKE/Child SA is estiblished, close the time event and free sent packet.
 336
 337   @param[in]   SessionCommon   Pointer to a Session Common.
 338
 339 **/
 340 VOID
 341 Ikev2SessionCommonRefresh (
 342   IN IKEV2_SESSION_COMMON      *SessionCommon
 343   )
 344 {
 345   ASSERT (SessionCommon != NULL);
 346
 347   gBS->CloseEvent (SessionCommon->TimeoutEvent);
 348   SessionCommon->TimeoutEvent     = NULL;
 349   SessionCommon->TimeoutInterval  = 0;
 350   SessionCommon->RetryCount       = 0;
 351   if (SessionCommon->LastSentPacket != NULL) {
 352     IkePacketFree (SessionCommon->LastSentPacket);
 353     SessionCommon->LastSentPacket = NULL;
 354   }
 355
 356   return ;
 357 }
 358 /**
 359   Free specified IKEV2 SA Session.
 360
 361   @param[in]    IkeSaSession   Pointer to IKEV2_SA_SESSION to be freed.
 362
 363 **/
 364 VOID
 365 Ikev2SaSessionFree (
 366   IN IKEV2_SA_SESSION         *IkeSaSession
 367   )
 368 {
 369   IKEV2_SESSION_KEYS      *IkeKeys;
 370   LIST_ENTRY              *Entry;
 371   IKEV2_CHILD_SA_SESSION  *ChildSa;
 372   IKEV2_DH_BUFFER         *DhBuffer;
 373
 374   ASSERT (IkeSaSession != NULL);
 375
 376   //
 377   // Delete Common Session
 378   //
 379   Ikev2SaSessionCommonFree (&IkeSaSession->SessionCommon);
 380
 381   //
 382   // Delete ChildSaEstablish List and SAD
 383   //
 384   for (Entry = IkeSaSession->ChildSaEstablishSessionList.ForwardLink;
 385        Entry != &IkeSaSession->ChildSaEstablishSessionList;
 386       ) {
 387
 388     ChildSa = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);
 389     Entry   = Entry->ForwardLink;
 390     Ikev2ChildSaSilentDelete (ChildSa->IkeSaSession, ChildSa->LocalPeerSpi);
 391
 392   }
 393
 394   //
 395   // Delete ChildSaSessionList
 396   //
 397   for ( Entry  = IkeSaSession->ChildSaSessionList.ForwardLink;
 398         Entry != &IkeSaSession->ChildSaSessionList;
 399         ){
 400     ChildSa = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);
 401     Entry   = Entry->ForwardLink;
 402     RemoveEntryList (Entry->BackLink);
 403     Ikev2ChildSaSessionFree (ChildSa);
 404   }
 405
 406   //
 407   // Delete DhBuffer and Keys
 408   //
 409   if (IkeSaSession->IkeKeys != NULL) {
 410     IkeKeys  = IkeSaSession->IkeKeys;
 411     DhBuffer = IkeKeys->DhBuffer;
 412
 413     //
 414     // Delete DhBuffer
 415     //
 416     Ikev2DhBufferFree (DhBuffer);
 417
 418     //
 419     // Delete Keys
 420     //
 421     if (IkeKeys->SkAiKey != NULL) {
 422       FreePool (IkeKeys->SkAiKey);
 423     }
 424     if (IkeKeys->SkArKey != NULL) {
 425       FreePool (IkeKeys->SkArKey);
 426     }
 427     if (IkeKeys->SkdKey != NULL) {
 428       FreePool (IkeKeys->SkdKey);
 429     }
 430     if (IkeKeys->SkEiKey != NULL) {
 431       FreePool (IkeKeys->SkEiKey);
 432     }
 433     if (IkeKeys->SkErKey != NULL) {
 434       FreePool (IkeKeys->SkErKey);
 435     }
 436     if (IkeKeys->SkPiKey != NULL) {
 437       FreePool (IkeKeys->SkPiKey);
 438     }
 439     if (IkeKeys->SkPrKey != NULL) {
 440       FreePool (IkeKeys->SkPrKey);
 441     }
 442     FreePool (IkeKeys);
 443   }
 444
 445   if (IkeSaSession->SaData != NULL) {
 446     FreePool (IkeSaSession->SaData);
 447   }
 448
 449   if (IkeSaSession->NiBlock != NULL) {
 450     FreePool (IkeSaSession->NiBlock);
 451   }
 452
 453   if (IkeSaSession->NrBlock != NULL) {
 454     FreePool (IkeSaSession->NrBlock);
 455   }
 456
 457   if (IkeSaSession->NCookie != NULL) {
 458     FreePool (IkeSaSession->NCookie);
 459   }
 460
 461   if (IkeSaSession->InitPacket != NULL) {
 462     FreePool (IkeSaSession->InitPacket);
 463   }
 464
 465   if (IkeSaSession->RespPacket != NULL) {
 466     FreePool (IkeSaSession->RespPacket);
 467   }
 468
 469   FreePool (IkeSaSession);
 470
 471   return ;
 472 }
 473
 474 /**
 475   Increase the MessageID in IkeSaSession.
 476
 477   @param[in] IkeSaSession Pointer to a specified IKEV2_SA_SESSION.
 478
 479 **/
 480 VOID
 481 Ikev2SaSessionIncreaseMessageId (
 482   IN IKEV2_SA_SESSION         *IkeSaSession
 483   )
 484 {
 485   if (IkeSaSession->MessageId < 0xffffffff) {
 486     IkeSaSession->MessageId ++;
 487   } else {
 488     //
 489     // TODO: Trigger Rekey process.
 490     //
 491   }
 492 }
 493
 494 /**
 495   Allocate memory for IKEV2 Child SA Session.
 496
 497   @param[in]   UdpService     Pointer to IKE_UDP_SERVICE.
 498   @param[in]   IkeSaSession   Pointer to IKEV2_SA_SESSION related to this Child SA
 499                               Session.
 500
 501   @retval  Pointer of a new created IKEV2 Child SA Session or NULL.
 502
 503 **/
 504 IKEV2_CHILD_SA_SESSION *
 505 Ikev2ChildSaSessionAlloc (
 506   IN IKE_UDP_SERVICE          *UdpService,
 507   IN IKEV2_SA_SESSION         *IkeSaSession
 508   )
 509 {
 510   EFI_STATUS                  Status;
 511   IKEV2_CHILD_SA_SESSION      *ChildSaSession;
 512   IKEV2_SESSION_COMMON        *ChildSaCommon;
 513   IKEV2_SESSION_COMMON        *SaCommon;
 514
 515   ChildSaSession = AllocateZeroPool (sizeof (IKEV2_CHILD_SA_SESSION));
 516   if (ChildSaSession == NULL) {
 517     return NULL;
 518   }
 519
 520   //
 521   // Initialize the fields of ChildSaSession and its SessionCommon.
 522   //
 523   ChildSaSession->Signature          = IKEV2_CHILD_SA_SESSION_SIGNATURE;
 524   ChildSaSession->IkeSaSession       = IkeSaSession;
 525   ChildSaSession->MessageId          = IkeSaSession->MessageId;
 526   ChildSaSession->LocalPeerSpi       = IkeGenerateSpi ();
 527   ChildSaCommon                      = &ChildSaSession->SessionCommon;
 528   ChildSaCommon->UdpService          = UdpService;
 529   ChildSaCommon->Private             = IkeSaSession->SessionCommon.Private;
 530   ChildSaCommon->IkeSessionType      = IkeSessionTypeChildSa;
 531   ChildSaCommon->IkeVer              = 2;
 532   ChildSaCommon->AfterEncodePayload  = Ikev2ChildSaAfterEncodePayload;
 533   ChildSaCommon->BeforeDecodePayload = Ikev2ChildSaBeforeDecodePayload;
 534   SaCommon = &ChildSaSession->IkeSaSession->SessionCommon;
 535
 536   //
 537   // Create a resend notfiy event for retry.
 538   //
 539   Status = gBS->CreateEvent (
 540                   EVT_TIMER | EVT_NOTIFY_SIGNAL,
 541                   TPL_CALLBACK,
 542                   Ikev2ResendNotify,
 543                   ChildSaCommon,
 544                   &ChildSaCommon->TimeoutEvent
 545                   );
 546   if (EFI_ERROR (Status)) {
 547     FreePool (ChildSaSession);
 548     return NULL;
 549   }
 550
 551   CopyMem (&ChildSaCommon->LocalPeerIp, &SaCommon->LocalPeerIp, sizeof (EFI_IP_ADDRESS));
 552   CopyMem (&ChildSaCommon->RemotePeerIp, &SaCommon->RemotePeerIp, sizeof (EFI_IP_ADDRESS));
 553
 554   return ChildSaSession;
 555 }
 556
 557 /**
 558   Register a established IKEv2 Child SA into IkeSaSession->ChildSaEstablishSessionList.
 559   If the there is IKEV2_CHILD_SA_SESSION with same remote peer IP, remove the old one
 560   then register the new one.
 561
 562   @param[in]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION to be registered.
 563   @param[in]  Private         Pointer to IPSEC_PRAVATE_DATA.
 564
 565 **/
 566 VOID
 567 Ikev2ChildSaSessionReg (
 568   IN IKEV2_CHILD_SA_SESSION    *ChildSaSession,
 569   IN IPSEC_PRIVATE_DATA        *Private
 570   )
 571 {
 572   IKEV2_SESSION_COMMON         *SessionCommon;
 573   IKEV2_CHILD_SA_SESSION       *OldChildSaSession;
 574   IKEV2_SA_SESSION             *IkeSaSession;
 575   EFI_STATUS                   Status;
 576   UINT64                       Lifetime;
 577
 578   //
 579   // Keep the IKE SA exclusive.
 580   //
 581   SessionCommon     = &ChildSaSession->SessionCommon;
 582   IkeSaSession      = ChildSaSession->IkeSaSession;
 583   OldChildSaSession = Ikev2ChildSaSessionRemove (
 584                         &IkeSaSession->ChildSaEstablishSessionList,
 585                         ChildSaSession->LocalPeerSpi,
 586                         IKEV2_ESTABLISHED_CHILDSA_LIST
 587                         );
 588   if (OldChildSaSession != NULL) {
 589     //
 590     // Free the old one.
 591     //
 592     Ikev2ChildSaSessionFree (OldChildSaSession);
 593   }
 594
 595   //
 596   // Store the ready child SA into SAD.
 597   //
 598   Ikev2StoreSaData (ChildSaSession);
 599
 600   //
 601   // Cleanup the fields of SessionCommon for processing.
 602   //
 603   Ikev2SessionCommonRefresh (SessionCommon);
 604
 605   //
 606   // Insert the ready child SA session into established list.
 607   //
 608   Ikev2ChildSaSessionInsert (&IkeSaSession->ChildSaEstablishSessionList, ChildSaSession);
 609
 610   //
 611   // Create a Notify event for the IKE SA life time counting.
 612   //
 613   Status = gBS->CreateEvent (
 614                   EVT_TIMER | EVT_NOTIFY_SIGNAL,
 615                   TPL_CALLBACK,
 616                   Ikev2LifetimeNotify,
 617                   SessionCommon,
 618                   &SessionCommon->TimeoutEvent
 619                   );
 620   if (EFI_ERROR(Status)){
 621     return ;
 622   }
 623
 624   //
 625   // Start to count the lifetime of the IKE SA.
 626   //
 627   if (ChildSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime != 0){
 628     Lifetime = ChildSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime;
 629   } else {
 630     Lifetime = CHILD_SA_DEFAULT_LIFETIME;
 631   }
 632
 633   Status = gBS->SetTimer (
 634                   SessionCommon->TimeoutEvent,
 635                   TimerRelative,
 636                   MultU64x32(Lifetime, 10000000) // ms->100ns
 637                   );
 638   if (EFI_ERROR(Status)){
 639     return ;
 640   }
 641
 642   DEBUG ((
 643     DEBUG_INFO,
 644     "\n------ChildSa established and start to count down %d seconds lifetime\n",
 645     Lifetime
 646     ));
 647
 648   return ;
 649 }
 650
 651 /**
 652   Find the ChildSaSession by it's MessagId.
 653
 654   @param[in] SaSessionList  Pointer to a ChildSaSession List.
 655   @param[in] Mid            The messageId used to search ChildSaSession.
 656
 657   @return Pointer to IKEV2_CHILD_SA_SESSION or NULL.
 658
 659 **/
 660 IKEV2_CHILD_SA_SESSION *
 661 Ikev2ChildSaSessionLookupByMid (
 662   IN LIST_ENTRY           *SaSessionList,
 663   IN UINT32               Mid
 664   )
 665 {
 666   LIST_ENTRY              *Entry;
 667   IKEV2_CHILD_SA_SESSION  *ChildSaSession;
 668
 669   NET_LIST_FOR_EACH (Entry, SaSessionList) {
 670     ChildSaSession  = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);
 671
 672     if (ChildSaSession->MessageId == Mid) {
 673       return ChildSaSession;
 674     }
 675   }
 676   return NULL;
 677 }
 678
 679 /**
 680   This function find the Child SA by the specified SPI.
 681
 682   This functin find a ChildSA session by searching the ChildSaSessionlist of
 683   the input IKEV2_SA_SESSION by specified MessageID.
 684
 685   @param[in]  SaSessionList      Pointer to List to be searched.
 686   @param[in]  Spi                Specified SPI.
 687
 688   @return Pointer to IKEV2_CHILD_SA_SESSION or NULL.
 689
 690 **/
 691 IKEV2_CHILD_SA_SESSION *
 692 Ikev2ChildSaSessionLookupBySpi (
 693   IN LIST_ENTRY           *SaSessionList,
 694   IN UINT32               Spi
 695   )
 696 {
 697   LIST_ENTRY              *Entry;
 698   IKEV2_CHILD_SA_SESSION  *ChildSaSession;
 699
 700   NET_LIST_FOR_EACH (Entry, SaSessionList) {
 701     ChildSaSession  = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);
 702
 703     if (ChildSaSession->RemotePeerSpi == Spi || ChildSaSession->LocalPeerSpi == Spi) {
 704       return ChildSaSession;
 705     }
 706   }
 707
 708   return NULL;
 709 }
 710
 711 /**
 712   Insert a Child SA Session into the specified ChildSa list.
 713
 714   @param[in]  SaSessionList   Pointer to list to be inserted in.
 715   @param[in]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION to be inserted.
 716
 717 **/
 718 VOID
 719 Ikev2ChildSaSessionInsert (
 720   IN LIST_ENTRY               *SaSessionList,
 721   IN IKEV2_CHILD_SA_SESSION   *ChildSaSession
 722   )
 723 {
 724  InsertTailList (SaSessionList, &ChildSaSession->ByIkeSa);
 725 }
 726
 727 /**
 728   Remove the IKEV2_CHILD_SA_SESSION from IkeSaSessionList.
 729
 730   @param[in]  SaSessionList      The SA Session List to be iterated.
 731   @param[in]  Spi                Spi used to identified the IKEV2_CHILD_SA_SESSION.
 732   @param[in]  ListType           The type of the List to indicate whether it is a
 733                                  Established.
 734
 735   @return The point to IKEV2_CHILD_SA_SESSION or NULL.
 736
 737 **/
 738 IKEV2_CHILD_SA_SESSION *
 739 Ikev2ChildSaSessionRemove (
 740   IN LIST_ENTRY           *SaSessionList,
 741   IN UINT32               Spi,
 742   IN UINT8                ListType
 743   )
 744 {
 745   LIST_ENTRY              *Entry;
 746   LIST_ENTRY              *NextEntry;
 747   IKEV2_CHILD_SA_SESSION  *ChildSaSession;
 748
 749   NET_LIST_FOR_EACH_SAFE (Entry, NextEntry, SaSessionList) {
 750
 751     if (ListType == IKEV2_ESTABLISHED_CHILDSA_LIST || ListType == IKEV2_ESTABLISHING_CHILDSA_LIST) {
 752       ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);
 753     } else if (ListType == IKEV2_DELET_CHILDSA_LIST) {
 754       ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_DEL_SA (Entry);
 755     } else {
 756       return NULL;
 757     }
 758
 759     if (ChildSaSession->RemotePeerSpi == Spi || ChildSaSession->LocalPeerSpi == Spi) {
 760       RemoveEntryList (Entry);
 761       return ChildSaSession;
 762     }
 763   }
 764
 765   return NULL;
 766 }
 767
 768 /**
 769   Mark a specified Child SA Session as on deleting.
 770
 771   @param[in]  ChildSaSession   Pointer to IKEV2_CHILD_SA_SESSION.
 772
 773   @retval     EFI_SUCCESS      Operation is successful.
 774
 775 **/
 776 EFI_STATUS
 777 Ikev2ChildSaSessionOnDeleting (
 778   IN IKEV2_CHILD_SA_SESSION   *ChildSaSession
 779   )
 780 {
 781   return EFI_SUCCESS;
 782 }
 783
 784 /**
 785   Free the memory located for the specified IKEV2_CHILD_SA_SESSION.
 786
 787   @param[in]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION.
 788
 789 **/
 790 VOID
 791 Ikev2ChildSaSessionFree (
 792   IN IKEV2_CHILD_SA_SESSION   *ChildSaSession
 793   )
 794 {
 795   IKEV2_SESSION_COMMON  *SessionCommon;
 796
 797   SessionCommon = &ChildSaSession->SessionCommon;
 798   if (ChildSaSession->SaData != NULL) {
 799     FreePool (ChildSaSession->SaData);
 800   }
 801
 802   if (ChildSaSession->NiBlock != NULL) {
 803     FreePool (ChildSaSession->NiBlock);
 804   }
 805
 806   if (ChildSaSession->NrBlock != NULL) {
 807     FreePool (ChildSaSession->NrBlock);
 808   }
 809
 810   if (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKey != NULL) {
 811     FreePool (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKey);
 812   }
 813
 814   if (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKey != NULL) {
 815     FreePool (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKey);
 816   }
 817
 818   if (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKey != NULL) {
 819     FreePool (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKey);
 820   }
 821
 822   if (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKey != NULL) {
 823     FreePool (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKey);
 824   }
 825
 826   //
 827   // Delete DhBuffer
 828   //
 829   Ikev2DhBufferFree (ChildSaSession->DhBuffer);
 830
 831   //
 832   // Delete SpdSelector
 833   //
 834   if (ChildSaSession->SpdSelector != NULL) {
 835     if (ChildSaSession->SpdSelector->LocalAddress != NULL) {
 836       FreePool (ChildSaSession->SpdSelector->LocalAddress);
 837     }
 838     if (ChildSaSession->SpdSelector->RemoteAddress != NULL) {
 839       FreePool (ChildSaSession->SpdSelector->RemoteAddress);
 840     }
 841     FreePool (ChildSaSession->SpdSelector);
 842   }
 843   Ikev2SaSessionCommonFree (SessionCommon);
 844   FreePool (ChildSaSession);
 845
 846   return ;
 847 }
 848
 849 /**
 850   Delete the specified established Child SA.
 851
 852   This function delete the Child SA directly and don't send the Information Packet to
 853   remote peer.
 854
 855   @param[in]  IkeSaSession   Pointer to a IKE SA Session used to be searched for.
 856   @param[in]  Spi            SPI used to find the Child SA.
 857
 858   @retval     EFI_NOT_FOUND  Pointer of IKE SA Session is NULL.
 859   @retval     EFI_NOT_FOUND  There is no specified Child SA related with the input
 860                              SPI under this IKE SA Session.
 861   @retval     EFI_SUCCESS    Delete the Child SA successfully.
 862
 863 **/
 864 EFI_STATUS
 865 Ikev2ChildSaSilentDelete (
 866   IN IKEV2_SA_SESSION       *IkeSaSession,
 867   IN UINT32                 Spi
 868   )
 869 {
 870   EFI_STATUS                Status;
 871   EFI_IPSEC_CONFIG_SELECTOR *Selector;
 872   UINTN                     SelectorSize;
 873   BOOLEAN                   IsLocalFound;
 874   BOOLEAN                   IsRemoteFound;
 875   UINT32                    LocalSpi;
 876   UINT32                    RemoteSpi;
 877   IKEV2_CHILD_SA_SESSION    *ChildSession;
 878   EFI_IPSEC_CONFIG_SELECTOR *LocalSelector;
 879   EFI_IPSEC_CONFIG_SELECTOR *RemoteSelector;
 880   IKE_UDP_SERVICE           *UdpService;
 881   IPSEC_PRIVATE_DATA        *Private;
 882
 883   if (IkeSaSession == NULL) {
 884     return EFI_NOT_FOUND;
 885   }
 886
 887   IsLocalFound    = FALSE;
 888   IsRemoteFound   = FALSE;
 889   ChildSession    = NULL;
 890   LocalSelector   = NULL;
 891   RemoteSelector  = NULL;
 892   UdpService      = IkeSaSession->SessionCommon.UdpService;
 893
 894   Private = IkeSaSession->SessionCommon.Private;
 895
 896   //
 897   // Remove the Established SA from ChildSaEstablishlist.
 898   //
 899   ChildSession = Ikev2ChildSaSessionRemove(
 900                    &(IkeSaSession->ChildSaEstablishSessionList),
 901                    Spi,
 902                    IKEV2_ESTABLISHED_CHILDSA_LIST
 903                    );
 904   if (ChildSession == NULL) {
 905     return EFI_NOT_FOUND;
 906   }
 907
 908   LocalSpi  = ChildSession->LocalPeerSpi;
 909   RemoteSpi = ChildSession->RemotePeerSpi;
 910
 911   SelectorSize  = sizeof (EFI_IPSEC_CONFIG_SELECTOR);
 912   Selector      = AllocateZeroPool (SelectorSize);
 913   ASSERT (Selector != NULL);
 914
 915
 916
 917   while (1) {
 918     Status = EfiIpSecConfigGetNextSelector (
 919                &Private->IpSecConfig,
 920                IPsecConfigDataTypeSad,
 921                &SelectorSize,
 922                Selector
 923                );
 924     if (Status == EFI_BUFFER_TOO_SMALL) {
 925       FreePool (Selector);
 926
 927       Selector = AllocateZeroPool (SelectorSize);
 928       ASSERT (Selector != NULL);
 929       Status   = EfiIpSecConfigGetNextSelector (
 930                    &Private->IpSecConfig,
 931                    IPsecConfigDataTypeSad,
 932                    &SelectorSize,
 933                    Selector
 934                    );
 935     }
 936
 937     if (EFI_ERROR (Status)) {
 938       break;
 939     }
 940
 941     if (Selector->SaId.Spi == RemoteSpi) {
 942       //
 943       // SPI is unique. There is only one SAD whose SPI is
 944       // same with RemoteSpi.
 945       //
 946       IsRemoteFound   = TRUE;
 947       RemoteSelector  = AllocateZeroPool (SelectorSize);
 948       ASSERT (RemoteSelector != NULL);
 949       CopyMem (RemoteSelector, Selector, SelectorSize);
 950     }
 951
 952     if (Selector->SaId.Spi == LocalSpi) {
 953       //
 954       // SPI is unique. There is only one SAD whose SPI is
 955       // same with LocalSpi.
 956       //
 957       IsLocalFound  = TRUE;
 958       LocalSelector = AllocateZeroPool (SelectorSize);
 959       ASSERT (LocalSelector != NULL);
 960       CopyMem (LocalSelector, Selector, SelectorSize);
 961     }
 962   }
 963   //
 964   // Delete SA from the Variable.
 965   //
 966   if (IsLocalFound) {
 967     Status = EfiIpSecConfigSetData (
 968                &Private->IpSecConfig,
 969                IPsecConfigDataTypeSad,
 970                LocalSelector,
 971                NULL,
 972                NULL
 973                );
 974   }
 975
 976   if (IsRemoteFound) {
 977     Status = EfiIpSecConfigSetData (
 978                &Private->IpSecConfig,
 979                IPsecConfigDataTypeSad,
 980                RemoteSelector,
 981                NULL,
 982                NULL
 983                );
 984
 985   }
 986
 987   DEBUG (
 988     (DEBUG_INFO,
 989     "\n------IKEV2 deleted ChildSa(local spi, remote spi):(0x%x, 0x%x)------\n",
 990     LocalSpi,
 991     RemoteSpi)
 992     );
 993   Ikev2ChildSaSessionFree (ChildSession);
 994
 995   if (RemoteSelector != NULL) {
 996     FreePool (RemoteSelector);
 997   }
 998
 999   if (LocalSelector != NULL) {
1000     FreePool (LocalSelector);
1001   }
1002
1003   if (Selector != NULL) {
1004     FreePool (Selector);
1005   }
1006
1007   return Status;
1008 }
1009
1010 /**
1011   Free the specified DhBuffer.
1012
1013   @param[in] DhBuffer   Pointer to IKEV2_DH_BUFFER to be freed.
1014
1015 **/
1016 VOID
1017 Ikev2DhBufferFree (
1018   IKEV2_DH_BUFFER *DhBuffer
1019 )
1020 {
1021   if (DhBuffer != NULL) {
1022     if (DhBuffer->GxBuffer != NULL) {
1023       FreePool (DhBuffer->GxBuffer);
1024     }
1025     if (DhBuffer->GyBuffer != NULL) {
1026       FreePool (DhBuffer->GyBuffer);
1027     }
1028     if (DhBuffer->GxyBuffer != NULL) {
1029       FreePool (DhBuffer->GxyBuffer);
1030     }
1031     if (DhBuffer->DhContext != NULL) {
1032       IpSecCryptoIoFreeDh (&DhBuffer->DhContext);
1033     }
1034     FreePool (DhBuffer);
1035   }
1036 }
1037
1038 /**
1039   This function is to parse a request IKE packet and return its request type.
1040   The request type is one of IKE CHILD SA creation, IKE SA rekeying and
1041   IKE CHILD SA rekeying.
1042
1043   @param[in] IkePacket  IKE packet to be prased.
1044
1045   return the type of the IKE packet.
1046
1047 **/
1048 IKEV2_CREATE_CHILD_REQUEST_TYPE
1049 Ikev2ChildExchangeRequestType(
1050   IN IKE_PACKET               *IkePacket
1051   )
1052 {
1053   BOOLEAN       Flag;
1054   LIST_ENTRY    *Entry;
1055   IKE_PAYLOAD   *IkePayload;
1056
1057   Flag            = FALSE;
1058
1059   NET_LIST_FOR_EACH (Entry, &(IkePacket)->PayloadList) {
1060     IkePayload  = IKE_PAYLOAD_BY_PACKET (Entry);
1061     if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_TS_INIT) {
1062       //
1063       // Packet with Ts Payload means it is for either CHILD_SA_CREATE or CHILD_SA_REKEY.
1064       //
1065       Flag = TRUE;
1066     }
1067     if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_NOTIFY) {
1068       if (((IKEV2_NOTIFY*)IkePayload)->MessageType == IKEV2_NOTIFICATION_REKEY_SA) {
1069         //
1070         // If notify payload with REKEY_SA message type, the IkePacket is for
1071         // rekeying Child SA.
1072         //
1073         return IkeRequestTypeRekeyChildSa;
1074       }
1075     }
1076   };
1077
1078   if (!Flag){
1079     //
1080     // The Create Child Exchange is for IKE SA rekeying.
1081     //
1082     return IkeRequestTypeRekeyIkeSa;
1083   } else {
1084     //
1085     // If the Notify payloaad with transport mode message type, the IkePacket is
1086     // for create Child SA.
1087     //
1088     return IkeRequestTypeCreateChildSa;
1089   }
1090 }
1091
1092 /**
1093   Associate a SPD selector to the Child SA Session.
1094
1095   This function is called when the Child SA is not the first child SA of its
1096   IKE SA. It associate a SPD to this Child SA.
1097
1098   @param[in, out]  ChildSaSession     Pointer to the Child SA Session to be associated to
1099                                       a SPD selector.
1100
1101   @retval EFI_SUCCESS        Associate one SPD selector to this Child SA Session successfully.
1102   @retval EFI_NOT_FOUND      Can't find the related SPD selector.
1103
1104 **/
1105 EFI_STATUS
1106 Ikev2ChildSaAssociateSpdEntry (
1107   IN OUT IKEV2_CHILD_SA_SESSION *ChildSaSession
1108   )
1109 {
1110   IpSecVisitConfigData (IPsecConfigDataTypeSpd, Ikev2MatchSpdEntry, ChildSaSession);
1111   if (ChildSaSession->Spd != NULL) {
1112     return EFI_SUCCESS;
1113   } else {
1114     return EFI_NOT_FOUND;
1115   }
1116 }
1117
1118
1119 /**
1120   This function finds the SPI from Create Child SA Exchange Packet.
1121
1122   @param[in] IkePacket       Pointer to IKE_PACKET to be searched.
1123
1124   @retval SPI number or 0 if it is not supported.
1125
1126 **/
1127 UINT32
1128 Ikev2ChildExchangeRekeySpi (
1129   IN IKE_PACKET               *IkePacket
1130   )
1131 {
1132   //
1133   // Not support yet.
1134   //
1135   return 0;
1136 }
1137
1138 /**
1139   Validate the IKE header of received IKE packet.
1140
1141   @param[in]   IkeSaSession  Pointer to IKEV2_SA_SESSION related to this IKE packet.
1142   @param[in]   IkeHdr        Pointer to IKE header of received IKE packet.
1143
1144   @retval TRUE   If the IKE header is valid.
1145   @retval FALSE  If the IKE header is invalid.
1146
1147 **/
1148 BOOLEAN
1149 Ikev2ValidateHeader (
1150   IN IKEV2_SA_SESSION         *IkeSaSession,
1151   IN IKE_HEADER               *IkeHdr
1152   )
1153 {
1154
1155   IKEV2_SESSION_STATE State;
1156
1157   State = IkeSaSession->SessionCommon.State;
1158   if (State == IkeStateInit) {
1159     //
1160     // For the IKE Initial Exchange, the MessagId should be zero.
1161     //
1162     if (IkeHdr->MessageId != 0) {
1163       return FALSE;
1164     }
1165   } else {
1166     if (State == IkeStateAuth) {
1167       if (IkeHdr->MessageId != 1) {
1168         return FALSE;
1169       }
1170     }
1171     if (IkeHdr->InitiatorCookie != IkeSaSession->InitiatorCookie ||
1172         IkeHdr->ResponderCookie != IkeSaSession->ResponderCookie
1173         ) {
1174       //
1175       // TODO: send notification INVALID-COOKIE
1176       //
1177       return FALSE;
1178     }
1179   }
1180
1181   //
1182   // Information Exchagne and Create Child Exchange can be started from each part.
1183   //
1184   if (IkeHdr->ExchangeType != IKEV2_EXCHANGE_TYPE_INFO &&
1185       IkeHdr->ExchangeType != IKEV2_EXCHANGE_TYPE_CREATE_CHILD
1186       ) {
1187     if (IkeSaSession->SessionCommon.IsInitiator) {
1188       if (IkeHdr->InitiatorCookie != IkeSaSession->InitiatorCookie) {
1189         //
1190         // TODO: send notification INVALID-COOKIE
1191         //
1192         return FALSE;
1193       }
1194       if (IkeHdr->Flags != IKE_HEADER_FLAGS_RESPOND) {
1195         return FALSE;
1196       }
1197     } else {
1198       if (IkeHdr->Flags != IKE_HEADER_FLAGS_INIT) {
1199         return FALSE;
1200       }
1201     }
1202   }
1203
1204   return TRUE;
1205 }
1206
1207 /**
1208   Create and intialize IKEV2_SA_DATA for speicifed IKEV2_SESSION_COMMON.
1209
1210   This function will be only called by the initiator. The responder's IKEV2_SA_DATA
1211   will be generated during parsed the initiator packet.
1212
1213   @param[in]  SessionCommon  Pointer to IKEV2_SESSION_COMMON related to.
1214
1215   @retval a Pointer to a new IKEV2_SA_DATA or NULL.
1216
1217 **/
1218 IKEV2_SA_DATA *
1219 Ikev2InitializeSaData (
1220   IN IKEV2_SESSION_COMMON     *SessionCommon
1221   )
1222 {
1223   IKEV2_CHILD_SA_SESSION      *ChildSaSession;
1224   IKEV2_SA_DATA               *SaData;
1225   IKEV2_PROPOSAL_DATA         *ProposalData;
1226   IKEV2_TRANSFORM_DATA        *TransformData;
1227   IKE_SA_ATTRIBUTE            *Attribute;
1228
1229   ASSERT (SessionCommon != NULL);
1230   //
1231   // TODO: Remove the hard code of the support Alogrithm. Those data should be
1232   // get from the SPD/PAD data.
1233   //
1234   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1235     SaData = AllocateZeroPool (
1236                sizeof (IKEV2_SA_DATA) +
1237                sizeof (IKEV2_PROPOSAL_DATA) * 2 +
1238                sizeof (IKEV2_TRANSFORM_DATA) * 4 * 2
1239                );
1240   } else {
1241     SaData = AllocateZeroPool (
1242                sizeof (IKEV2_SA_DATA) +
1243                sizeof (IKEV2_PROPOSAL_DATA) * 2 +
1244                sizeof (IKEV2_TRANSFORM_DATA) * 3 * 2
1245                );
1246   }
1247   if (SaData == NULL) {
1248     return NULL;
1249   }
1250
1251   //
1252   // First proposal payload: 3DES + SHA1 + DH
1253   //
1254   SaData->NumProposals          = 2;
1255   ProposalData                  = (IKEV2_PROPOSAL_DATA *) (SaData + 1);
1256   ProposalData->ProposalIndex   = 1;
1257
1258   //
1259   // If SA data for IKE_SA_INIT exchage, contains 4 transforms. If SA data for
1260   // IKE_AUTH exchange contains 3 transforms.
1261   //
1262   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1263     ProposalData->NumTransforms   = 4;
1264   } else {
1265     ProposalData->NumTransforms   = 3;
1266   }
1267
1268
1269   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1270     ProposalData->ProtocolId    = IPSEC_PROTO_ISAKMP;
1271   } else {
1272     ChildSaSession              = IKEV2_CHILD_SA_SESSION_FROM_COMMON (SessionCommon);
1273     ProposalData->ProtocolId    = IPSEC_PROTO_IPSEC_ESP;
1274     ProposalData->Spi           = AllocateZeroPool (sizeof (ChildSaSession->LocalPeerSpi));
1275     ASSERT (ProposalData->Spi != NULL);
1276     CopyMem (
1277       ProposalData->Spi,
1278       &ChildSaSession->LocalPeerSpi,
1279       sizeof(ChildSaSession->LocalPeerSpi)
1280     );
1281   }
1282
1283   //
1284   // Set transform attribute for Encryption Algorithm - 3DES
1285   //
1286   TransformData                 = (IKEV2_TRANSFORM_DATA *) (ProposalData + 1);
1287   TransformData->TransformIndex = 0;
1288   TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_ENCR;
1289   TransformData->TransformId    = IKEV2_TRANSFORM_ID_ENCR_3DES;
1290
1291   //
1292   // Set transform attribute for Integrity Algorithm - SHA1_96
1293   //
1294   TransformData                 = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);
1295   TransformData->TransformIndex = 1;
1296   TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_INTEG;
1297   TransformData->TransformId    = IKEV2_TRANSFORM_ID_AUTH_HMAC_SHA1_96;
1298
1299   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1300     //
1301     // Set transform attribute for Pseduo-Random Function - HAMC_SHA1
1302     //
1303     TransformData                 = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);
1304     TransformData->TransformIndex = 2;
1305     TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_PRF;
1306     TransformData->TransformId    = IKEV2_TRANSFORM_ID_PRF_HMAC_SHA1;
1307   }
1308
1309   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1310     //
1311     // Set transform attribute for DH Group - DH 1024
1312     //
1313     TransformData                 = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);
1314     TransformData->TransformIndex = 3;
1315     TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_DH;
1316     TransformData->TransformId    = IKEV2_TRANSFORM_ID_DH_1024MODP;
1317   } else {
1318     //
1319     // Transform type for Extended Sequence Numbers. Currently not support Extended
1320     // Sequence Number.
1321     //
1322     TransformData                 = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);
1323     TransformData->TransformIndex = 2;
1324     TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_ESN;
1325     TransformData->TransformId    = 0;
1326   }
1327
1328   //
1329   // Second proposal payload: 3DES + SHA1 + DH
1330   //
1331   ProposalData                  = (IKEV2_PROPOSAL_DATA *) (TransformData + 1);
1332   ProposalData->ProposalIndex   = 2;
1333
1334   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1335     ProposalData->ProtocolId      = IPSEC_PROTO_ISAKMP;
1336     ProposalData->NumTransforms   = 4;
1337   } else {
1338
1339     ChildSaSession              = IKEV2_CHILD_SA_SESSION_FROM_COMMON (SessionCommon);
1340     ProposalData->ProtocolId    = IPSEC_PROTO_IPSEC_ESP;
1341     ProposalData->NumTransforms = 3;
1342     ProposalData->Spi           = AllocateZeroPool (sizeof (ChildSaSession->LocalPeerSpi));
1343     ASSERT (ProposalData->Spi != NULL);
1344     CopyMem (
1345       ProposalData->Spi,
1346       &ChildSaSession->LocalPeerSpi,
1347       sizeof(ChildSaSession->LocalPeerSpi)
1348     );
1349   }
1350
1351   //
1352   // Set transform attribute for Encryption Algorithm - AES-CBC
1353   //
1354   TransformData                 = (IKEV2_TRANSFORM_DATA *) (ProposalData + 1);
1355   TransformData->TransformIndex = 0;
1356   TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_ENCR;
1357   TransformData->TransformId    = IKEV2_TRANSFORM_ID_ENCR_AES_CBC;
1358   Attribute                     = &TransformData->Attribute;
1359   Attribute->AttrType           = IKEV2_ATTRIBUTE_TYPE_KEYLEN;
1360   Attribute->Attr.AttrLength    = (UINT16) (8 * IpSecGetEncryptKeyLength (IKEV2_TRANSFORM_ID_ENCR_AES_CBC));
1361
1362   //
1363   // Set transform attribute for Integrity Algorithm - SHA1_96
1364   //
1365   TransformData                 = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);
1366   TransformData->TransformIndex = 1;
1367   TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_INTEG;
1368   TransformData->TransformId    = IKEV2_TRANSFORM_ID_AUTH_HMAC_SHA1_96;
1369
1370   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1371     //
1372     // Set transform attribute for Pseduo-Random Function - HAMC_SHA1
1373     //
1374     TransformData                 = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);
1375     TransformData->TransformIndex = 2;
1376     TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_PRF;
1377     TransformData->TransformId    = IKEV2_TRANSFORM_ID_PRF_HMAC_SHA1;
1378   }
1379
1380   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1381     //
1382     // Set transform attrbiute for DH Group - DH-1024
1383     //
1384     TransformData                 = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);
1385     TransformData->TransformIndex = 3;
1386     TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_DH;
1387     TransformData->TransformId    = IKEV2_TRANSFORM_ID_DH_1024MODP;
1388   } else {
1389     //
1390     // Transform type for Extended Sequence Numbers. Currently not support Extended
1391     // Sequence Number.
1392     //
1393     TransformData                 = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);
1394     TransformData->TransformIndex = 2;
1395     TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_ESN;
1396     TransformData->TransformId    = 0;
1397   }
1398
1399   return SaData;
1400 }
1401
1402 /**
1403   Store the SA into SAD.
1404
1405   @param[in]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION.
1406
1407 **/
1408 VOID
1409 Ikev2StoreSaData (
1410   IN IKEV2_CHILD_SA_SESSION   *ChildSaSession
1411   )
1412 {
1413   EFI_STATUS                  Status;
1414   EFI_IPSEC_SA_ID             SaId;
1415   EFI_IPSEC_SA_DATA2           SaData;
1416   IKEV2_SESSION_COMMON        *SessionCommon;
1417   IPSEC_PRIVATE_DATA          *Private;
1418   UINT32                      TempAddressCount;
1419   EFI_IP_ADDRESS_INFO         *TempAddressInfo;
1420
1421   SessionCommon             = &ChildSaSession->SessionCommon;
1422   Private                   = SessionCommon->Private;
1423
1424   ZeroMem (&SaId, sizeof (EFI_IPSEC_SA_ID));
1425   ZeroMem (&SaData, sizeof (EFI_IPSEC_SA_DATA2));
1426
1427   //
1428   // Create a SpdSelector. In this implementation, one SPD represents
1429   // 2 direction traffic, so in here, there needs to reverse the local address
1430   // and remote address for Remote Peer's SA, then reverse again for the locate
1431   // SA.
1432   //
1433   TempAddressCount = ChildSaSession->SpdSelector->LocalAddressCount;
1434   TempAddressInfo  = ChildSaSession->SpdSelector->LocalAddress;
1435
1436   ChildSaSession->SpdSelector->LocalAddressCount = ChildSaSession->SpdSelector->RemoteAddressCount;
1437   ChildSaSession->SpdSelector->LocalAddress      = ChildSaSession->SpdSelector->RemoteAddress;
1438
1439   ChildSaSession->SpdSelector->RemoteAddress     = TempAddressInfo;
1440   ChildSaSession->SpdSelector->RemoteAddressCount= TempAddressCount;
1441
1442   //
1443   // Set the SaId and SaData.
1444   //
1445   SaId.Spi                 = ChildSaSession->LocalPeerSpi;
1446   SaId.Proto               = EfiIPsecESP;
1447   SaData.AntiReplayWindows = 16;
1448   SaData.SNCount           = 0;
1449   SaData.Mode              = ChildSaSession->Spd->Data->ProcessingPolicy->Mode;
1450
1451   //
1452   // If it is tunnel mode, should add the TunnelDest and TunnelSource for SaData.
1453   //
1454   if (SaData.Mode == EfiIPsecTunnel) {
1455     CopyMem (
1456       &SaData.TunnelSourceAddress,
1457       &ChildSaSession->Spd->Data->ProcessingPolicy->TunnelOption->RemoteTunnelAddress,
1458       sizeof (EFI_IP_ADDRESS)
1459       );
1460     CopyMem (
1461       &SaData.TunnelDestinationAddress,
1462       &ChildSaSession->Spd->Data->ProcessingPolicy->TunnelOption->LocalTunnelAddress,
1463       sizeof (EFI_IP_ADDRESS)
1464       );
1465   }
1466
1467   CopyMem (&SaId.DestAddress, &ChildSaSession->SessionCommon.LocalPeerIp, sizeof (EFI_IP_ADDRESS));
1468   CopyMem (&SaData.AlgoInfo, &ChildSaSession->ChildKeymats.LocalPeerInfo, sizeof (EFI_IPSEC_ALGO_INFO));
1469   SaData.SpdSelector = ChildSaSession->SpdSelector;
1470
1471   //
1472   // Store the remote SA into SAD.
1473   //
1474   Status = EfiIpSecConfigSetData (
1475              &Private->IpSecConfig,
1476              IPsecConfigDataTypeSad,
1477              (EFI_IPSEC_CONFIG_SELECTOR *) &SaId,
1478              &SaData,
1479              NULL
1480              );
1481   ASSERT_EFI_ERROR (Status);
1482
1483   //
1484   // Store the local SA into SAD.
1485   //
1486   ChildSaSession->SpdSelector->RemoteAddressCount = ChildSaSession->SpdSelector->LocalAddressCount;
1487   ChildSaSession->SpdSelector->RemoteAddress      = ChildSaSession->SpdSelector->LocalAddress;
1488
1489   ChildSaSession->SpdSelector->LocalAddress       = TempAddressInfo;
1490   ChildSaSession->SpdSelector->LocalAddressCount  = TempAddressCount;
1491
1492   SaId.Spi = ChildSaSession->RemotePeerSpi;
1493
1494   CopyMem (&SaId.DestAddress, &ChildSaSession->SessionCommon.RemotePeerIp, sizeof (EFI_IP_ADDRESS));
1495   CopyMem (&SaData.AlgoInfo, &ChildSaSession->ChildKeymats.RemotePeerInfo, sizeof (EFI_IPSEC_ALGO_INFO));
1496   SaData.SpdSelector = ChildSaSession->SpdSelector;
1497
1498   //
1499   // If it is tunnel mode, should add the TunnelDest and TunnelSource for SaData.
1500   //
1501   if (SaData.Mode == EfiIPsecTunnel) {
1502     CopyMem (
1503       &SaData.TunnelSourceAddress,
1504       &ChildSaSession->Spd->Data->ProcessingPolicy->TunnelOption->LocalTunnelAddress,
1505       sizeof (EFI_IP_ADDRESS)
1506       );
1507     CopyMem (
1508       &SaData.TunnelDestinationAddress,
1509       &ChildSaSession->Spd->Data->ProcessingPolicy->TunnelOption->RemoteTunnelAddress,
1510       sizeof (EFI_IP_ADDRESS)
1511       );
1512   }
1513
1514   Status = EfiIpSecConfigSetData (
1515              &Private->IpSecConfig,
1516              IPsecConfigDataTypeSad,
1517              (EFI_IPSEC_CONFIG_SELECTOR *) &SaId,
1518              &SaData,
1519              NULL
1520              );
1521
1522   ASSERT_EFI_ERROR (Status);
1523 }
1524
1525 /**
1526   Call back function of the IKE life time is over.
1527
1528   This function will mark the related IKE SA Session as deleting and trigger a
1529   Information negotiation.
1530
1531   @param[in]    Event     The signaled Event.
1532   @param[in]    Context   Pointer to data passed by caller.
1533
1534 **/
1535 VOID
1536 EFIAPI
1537 Ikev2LifetimeNotify (
1538   IN EFI_EVENT                Event,
1539   IN VOID                     *Context
1540   )
1541 {
1542   IKEV2_SA_SESSION            *IkeSaSession;
1543   IKEV2_CHILD_SA_SESSION      *ChildSaSession;
1544   IKEV2_SESSION_COMMON        *SessionCommon;
1545
1546   ASSERT (Context != NULL);
1547   SessionCommon = (IKEV2_SESSION_COMMON *) Context;
1548
1549   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1550     IkeSaSession = IKEV2_SA_SESSION_FROM_COMMON (SessionCommon);
1551     DEBUG ((
1552       DEBUG_INFO,
1553       "\n---IkeSa Lifetime is out(cookie_i, cookie_r):(0x%lx, 0x%lx)---\n",
1554       IkeSaSession->InitiatorCookie,
1555       IkeSaSession->ResponderCookie
1556       ));
1557
1558     //
1559     // Change the  IKE SA Session's State to IKE_STATE_SA_DELETING.
1560     //
1561     IKEV2_DUMP_STATE (IkeSaSession->SessionCommon.State, IkeStateSaDeleting);
1562     IkeSaSession->SessionCommon.State = IkeStateSaDeleting;
1563
1564   } else {
1565     ChildSaSession = IKEV2_CHILD_SA_SESSION_FROM_COMMON (SessionCommon);
1566     IkeSaSession   = ChildSaSession->IkeSaSession;
1567
1568     //
1569     // Link the timeout child SA to the DeleteSaList.
1570     //
1571     InsertTailList (&IkeSaSession->DeleteSaList, &ChildSaSession->ByDelete);
1572
1573     //
1574     // Change the Child SA Session's State to IKE_STATE_SA_DELETING.
1575     //
1576     DEBUG ((
1577       DEBUG_INFO,
1578       "\n------ChildSa Lifetime is out(SPI):(0x%x)------\n",
1579       ChildSaSession->LocalPeerSpi
1580       ));
1581   }
1582
1583   //
1584   // TODO: Send the delete info packet or delete silently
1585   //
1586   mIkev2Exchange.NegotiateInfo ((UINT8 *) IkeSaSession, NULL);
1587 }
1588
1589 /**
1590   This function will be called if the TimeOut Event is signaled.
1591
1592   @param[in]  Event      The signaled Event.
1593   @param[in]  Context    The data passed by caller.
1594
1595 **/
1596 VOID
1597 EFIAPI
1598 Ikev2ResendNotify (
1599   IN EFI_EVENT                 Event,
1600   IN VOID                      *Context
1601   )
1602 {
1603   IPSEC_PRIVATE_DATA           *Private;
1604   IKEV2_SA_SESSION             *IkeSaSession;
1605   IKEV2_CHILD_SA_SESSION       *ChildSaSession;
1606   IKEV2_SESSION_COMMON         *SessionCommon;
1607   LIST_ENTRY                   *ChildSaEntry;
1608   UINT8                        Value;
1609   EFI_STATUS                   Status;
1610
1611   ASSERT (Context != NULL);
1612   IkeSaSession   = NULL;
1613   ChildSaSession = NULL;
1614   SessionCommon  = (IKEV2_SESSION_COMMON *) Context;
1615   Private        = SessionCommon->Private;
1616
1617   //
1618   // Remove the SA session from the processing list if exceed the max retry.
1619   //
1620   if (SessionCommon->RetryCount > IKE_MAX_RETRY) {
1621     if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1622       IkeSaSession = IKEV2_SA_SESSION_FROM_COMMON (SessionCommon);
1623       if (IkeSaSession->SessionCommon.State == IkeStateSaDeleting) {
1624
1625         //
1626         // If the IkeSaSession is initiator, delete all its Child SAs before removing IKE SA.
1627         // If the IkesaSession is responder, all ChildSa has been remove in Ikev2HandleInfo();
1628         //
1629         for (ChildSaEntry = IkeSaSession->ChildSaEstablishSessionList.ForwardLink;
1630              ChildSaEntry != &IkeSaSession->ChildSaEstablishSessionList;
1631         ) {
1632           ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (ChildSaEntry);
1633           //
1634           // Move to next ChildSa Entry.
1635           //
1636           ChildSaEntry = ChildSaEntry->ForwardLink;
1637           //
1638           // Delete LocalSpi & RemoteSpi and remove the ChildSaSession from the
1639           // EstablishedChildSaList.
1640           //
1641           Ikev2ChildSaSilentDelete (IkeSaSession, ChildSaSession->LocalPeerSpi);
1642         }
1643
1644         //
1645         // If the IKE SA Delete Payload wasn't sent out successfully, Delete it from the EstablishedList.
1646         //
1647         Ikev2SaSessionRemove (&Private->Ikev2EstablishedList, &SessionCommon->RemotePeerIp);
1648
1649         if (Private != NULL && Private->IsIPsecDisabling) {
1650             //
1651             // After all IKE SAs were deleted, set the IPSEC_STATUS_DISABLED value in
1652             // IPsec status variable.
1653             //
1654             if (IsListEmpty (&Private->Ikev1EstablishedList) && IsListEmpty (&Private->Ikev2EstablishedList)) {
1655               Value = IPSEC_STATUS_DISABLED;
1656               Status = gRT->SetVariable (
1657                               IPSECCONFIG_STATUS_NAME,
1658                               &gEfiIpSecConfigProtocolGuid,
1659                               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_NON_VOLATILE,
1660                               sizeof (Value),
1661                               &Value
1662                               );
1663               if (!EFI_ERROR (Status)) {
1664                 //
1665                 // Set the Disabled Flag in Private data.
1666                 //
1667                 Private->IpSec.DisabledFlag = TRUE;
1668                 Private->IsIPsecDisabling   = FALSE;
1669               }
1670             }
1671           }
1672       } else {
1673         Ikev2SaSessionRemove (&Private->Ikev2SessionList, &SessionCommon->RemotePeerIp);
1674       }
1675       Ikev2SaSessionFree (IkeSaSession);
1676
1677     } else {
1678
1679       //
1680       // If the packet sent by Child SA.
1681       //
1682       ChildSaSession = IKEV2_CHILD_SA_SESSION_FROM_COMMON (SessionCommon);
1683       IkeSaSession   = ChildSaSession->IkeSaSession;
1684       if (ChildSaSession->SessionCommon.State == IkeStateSaDeleting) {
1685
1686         //
1687         // Established Child SA should be remove from the SAD entry and
1688         // DeleteList. The function of Ikev2DeleteChildSaSilent() will remove
1689         // the childSA from the IkeSaSession->ChildSaEstablishedList. So there
1690         // is no need to remove it here.
1691         //
1692         Ikev2ChildSaSilentDelete (IkeSaSession, ChildSaSession->LocalPeerSpi);
1693         Ikev2ChildSaSessionRemove (
1694           &IkeSaSession->DeleteSaList,
1695           ChildSaSession->LocalPeerSpi,
1696           IKEV2_DELET_CHILDSA_LIST
1697           );
1698       } else {
1699         Ikev2ChildSaSessionRemove (
1700           &IkeSaSession->ChildSaSessionList,
1701           ChildSaSession->LocalPeerSpi,
1702           IKEV2_ESTABLISHING_CHILDSA_LIST
1703           );
1704       }
1705
1706       Ikev2ChildSaSessionFree (ChildSaSession);
1707     }
1708     return ;
1709   }
1710
1711   //
1712   // Increase the retry count.
1713   //
1714   SessionCommon->RetryCount++;
1715   DEBUG ((DEBUG_INFO, ">>>Resending the last packet ...\n"));
1716
1717   //
1718   // Resend the last packet.
1719   //
1720   Ikev2SendIkePacket (
1721     SessionCommon->UdpService,
1722     (UINT8*)SessionCommon,
1723     SessionCommon->LastSentPacket,
1724     0
1725     );
1726 }
1727
1728 /**
1729   Copy ChildSaSession->Spd->Selector to ChildSaSession->SpdSelector.
1730
1731   ChildSaSession->SpdSelector stores the real Spdselector for its SA. Sometime,
1732   the SpdSelector in ChildSaSession is more accurated or the scope is smaller
1733   than the one in ChildSaSession->Spd, especially for the tunnel mode.
1734
1735   @param[in, out]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION related to.
1736
1737 **/
1738 VOID
1739 Ikev2ChildSaSessionSpdSelectorCreate (
1740   IN OUT IKEV2_CHILD_SA_SESSION *ChildSaSession
1741   )
1742 {
1743   if (ChildSaSession->Spd != NULL && ChildSaSession->Spd->Selector != NULL) {
1744     if (ChildSaSession->SpdSelector == NULL) {
1745       ChildSaSession->SpdSelector = AllocateZeroPool (sizeof (EFI_IPSEC_SPD_SELECTOR));
1746       ASSERT (ChildSaSession->SpdSelector != NULL);
1747     }
1748     CopyMem (
1749       ChildSaSession->SpdSelector,
1750       ChildSaSession->Spd->Selector,
1751       sizeof (EFI_IPSEC_SPD_SELECTOR)
1752       );
1753     ChildSaSession->SpdSelector->RemoteAddress = AllocateCopyPool (
1754                                                    ChildSaSession->Spd->Selector->RemoteAddressCount *
1755                                                    sizeof (EFI_IP_ADDRESS_INFO),
1756                                                    ChildSaSession->Spd->Selector->RemoteAddress
1757                                                    );
1758     ChildSaSession->SpdSelector->LocalAddress = AllocateCopyPool (
1759                                                   ChildSaSession->Spd->Selector->LocalAddressCount *
1760                                                   sizeof (EFI_IP_ADDRESS_INFO),
1761                                                   ChildSaSession->Spd->Selector->LocalAddress
1762                                                   );
1763
1764     ASSERT (ChildSaSession->SpdSelector->LocalAddress != NULL);
1765     ASSERT (ChildSaSession->SpdSelector->RemoteAddress != NULL);
1766
1767     ChildSaSession->SpdSelector->RemoteAddressCount = ChildSaSession->Spd->Selector->RemoteAddressCount;
1768     ChildSaSession->SpdSelector->LocalAddressCount = ChildSaSession->Spd->Selector->LocalAddressCount;
1769   }
1770 }
1771
1772 /**
1773   Generate a ChildSa Session and insert it into related IkeSaSession.
1774
1775   @param[in]  IkeSaSession    Pointer to related IKEV2_SA_SESSION.
1776   @param[in]  UdpService      Pointer to related IKE_UDP_SERVICE.
1777
1778   @return pointer of IKEV2_CHILD_SA_SESSION.
1779
1780 **/
1781 IKEV2_CHILD_SA_SESSION *
1782 Ikev2ChildSaSessionCreate (
1783   IN IKEV2_SA_SESSION   *IkeSaSession,
1784   IN IKE_UDP_SERVICE     *UdpService
1785   )
1786 {
1787   IKEV2_CHILD_SA_SESSION    *ChildSaSession;
1788   IKEV2_SESSION_COMMON      *ChildSaCommon;
1789
1790   //
1791   // Create a new ChildSaSession.Insert it into processing list and initiate the common parameters.
1792   //
1793   ChildSaSession = Ikev2ChildSaSessionAlloc (UdpService, IkeSaSession);
1794   ASSERT (ChildSaSession != NULL);
1795
1796   //
1797   // Set the specific parameters.
1798   //
1799   ChildSaSession->Spd        = IkeSaSession->Spd;
1800   ChildSaCommon              = &ChildSaSession->SessionCommon;
1801   ChildSaCommon->IsInitiator = IkeSaSession->SessionCommon.IsInitiator;
1802   if (IkeSaSession->SessionCommon.State == IkeStateAuth) {
1803     ChildSaCommon->State     = IkeStateAuth;
1804     IKEV2_DUMP_STATE (ChildSaCommon->State, IkeStateAuth);
1805   } else {
1806     ChildSaCommon->State     = IkeStateCreateChild;
1807     IKEV2_DUMP_STATE (ChildSaCommon->State, IkeStateCreateChild);
1808   }
1809
1810   //
1811   // If SPD->Selector is not NULL, copy it to the ChildSaSession->SpdSelector.
1812   // The ChildSaSession->SpdSelector might be changed after the traffic selector
1813   // negoniation and it will be copied into the SAData after ChildSA established.
1814   //
1815   Ikev2ChildSaSessionSpdSelectorCreate (ChildSaSession);
1816
1817   //
1818   // Copy first NiBlock and NrBlock to ChildSa Session
1819   //
1820   ChildSaSession->NiBlock   = AllocateZeroPool (IkeSaSession->NiBlkSize);
1821   ASSERT (ChildSaSession->NiBlock != NULL);
1822   ChildSaSession->NiBlkSize = IkeSaSession->NiBlkSize;
1823   CopyMem (ChildSaSession->NiBlock, IkeSaSession->NiBlock, IkeSaSession->NiBlkSize);
1824
1825   ChildSaSession->NrBlock   = AllocateZeroPool (IkeSaSession->NrBlkSize);
1826   ASSERT (ChildSaSession->NrBlock != NULL);
1827   ChildSaSession->NrBlkSize = IkeSaSession->NrBlkSize;
1828   CopyMem (ChildSaSession->NrBlock, IkeSaSession->NrBlock, IkeSaSession->NrBlkSize);
1829
1830   //
1831   //  Only if the Create Child SA is called for the IKE_INIT Exchange and
1832   //  IkeSaSession is initiator (Only Initiator's SPD is not NULL), Set the
1833   //  Traffic Selectors related information here.
1834   //
1835   if (IkeSaSession->SessionCommon.State == IkeStateAuth && IkeSaSession->Spd != NULL) {
1836     ChildSaSession->ProtoId = IkeSaSession->Spd->Selector->NextLayerProtocol;
1837     ChildSaSession->LocalPort = IkeSaSession->Spd->Selector->LocalPort;
1838     ChildSaSession->RemotePort = IkeSaSession->Spd->Selector->RemotePort;
1839   }
1840
1841   //
1842   // Insert the new ChildSaSession into processing child SA list.
1843   //
1844   Ikev2ChildSaSessionInsert (&IkeSaSession->ChildSaSessionList, ChildSaSession);
1845   return ChildSaSession;
1846 }
1847
1848 /**
1849   Check if the SPD is related to the input Child SA Session.
1850
1851   This function is the subfunction of Ikev1AssociateSpdEntry(). It is the call
1852   back function of IpSecVisitConfigData().
1853
1854
1855   @param[in]  Type               Type of the input Config Selector.
1856   @param[in]  Selector           Pointer to the Configure Selector to be checked.
1857   @param[in]  Data               Pointer to the Configure Selector's Data passed
1858                                  from the caller.
1859   @param[in]  SelectorSize       The buffer size of Selector.
1860   @param[in]  DataSize           The buffer size of the Data.
1861   @param[in]  Context            The data passed from the caller. It is a Child
1862                                  SA Session in this context.
1863
1864   @retval EFI_SUCCESS        The SPD Selector is not related to the Child SA Session.
1865   @retval EFI_ABORTED        The SPD Selector is related to the Child SA session and
1866                              set the ChildSaSession->Spd to point to this SPD Selector.
1867
1868 **/
1869 EFI_STATUS
1870 Ikev2MatchSpdEntry (
1871   IN EFI_IPSEC_CONFIG_DATA_TYPE     Type,
1872   IN EFI_IPSEC_CONFIG_SELECTOR      *Selector,
1873   IN VOID                           *Data,
1874   IN UINTN                          SelectorSize,
1875   IN UINTN                          DataSize,
1876   IN VOID                           *Context
1877   )
1878 {
1879   IKEV2_CHILD_SA_SESSION  *ChildSaSession;
1880   EFI_IPSEC_SPD_SELECTOR  *SpdSelector;
1881   EFI_IPSEC_SPD_DATA      *SpdData;
1882   BOOLEAN                 IsMatch;
1883   UINT8                   IpVersion;
1884
1885   ASSERT (Type == IPsecConfigDataTypeSpd);
1886   SpdData = (EFI_IPSEC_SPD_DATA *) Data;
1887   //
1888   // Bypass all non-protect SPD entry first
1889   //
1890   if (SpdData->Action != EfiIPsecActionProtect) {
1891     return EFI_SUCCESS;
1892   }
1893
1894   ChildSaSession  = (IKEV2_CHILD_SA_SESSION *) Context;
1895   IpVersion       = ChildSaSession->SessionCommon.UdpService->IpVersion;
1896   SpdSelector     = (EFI_IPSEC_SPD_SELECTOR *) Selector;
1897   IsMatch         = TRUE;
1898
1899   if (SpdSelector->NextLayerProtocol == EFI_IP_PROTO_UDP &&
1900       SpdSelector->LocalPort == IKE_DEFAULT_PORT &&
1901       SpdSelector->LocalPortRange == 0 &&
1902       SpdSelector->RemotePort == IKE_DEFAULT_PORT &&
1903       SpdSelector->RemotePortRange == 0
1904       ) {
1905     //
1906     // TODO: Skip IKE Policy here or set a SPD entry?
1907     //
1908     return EFI_SUCCESS;
1909   }
1910
1911   if (SpdSelector->NextLayerProtocol != EFI_IPSEC_ANY_PROTOCOL &&
1912       SpdSelector->NextLayerProtocol != ChildSaSession->ProtoId
1913       ) {
1914     IsMatch = FALSE;
1915   }
1916
1917   if (SpdSelector->LocalPort != EFI_IPSEC_ANY_PORT && SpdSelector->LocalPort != ChildSaSession->LocalPort) {
1918     IsMatch = FALSE;
1919   }
1920
1921   if (SpdSelector->RemotePort != EFI_IPSEC_ANY_PORT && SpdSelector->RemotePort != ChildSaSession->RemotePort) {
1922     IsMatch = FALSE;
1923   }
1924
1925   IsMatch = (BOOLEAN) (IsMatch &&
1926                        IpSecMatchIpAddress (
1927                          IpVersion,
1928                          &ChildSaSession->SessionCommon.LocalPeerIp,
1929                          SpdSelector->LocalAddress,
1930                          SpdSelector->LocalAddressCount
1931                          ));
1932
1933   IsMatch = (BOOLEAN) (IsMatch &&
1934                        IpSecMatchIpAddress (
1935                          IpVersion,
1936                          &ChildSaSession->SessionCommon.RemotePeerIp,
1937                          SpdSelector->RemoteAddress,
1938                          SpdSelector->RemoteAddressCount
1939                          ));
1940
1941   if (IsMatch) {
1942     ChildSaSession->Spd = IkeSearchSpdEntry (SpdSelector);
1943     return EFI_ABORTED;
1944   } else {
1945     return EFI_SUCCESS;
1946   }
1947 }
1948
1949 /**
1950   Check if the Algorithm ID is supported.
1951
1952   @param[in]  AlgorithmId The specified Algorithm ID.
1953   @param[in]  Type        The type used to indicate the Algorithm is for Encrypt or
1954                           Authentication.
1955
1956   @retval     TRUE        If the Algorithm ID is supported.
1957   @retval     FALSE       If the Algorithm ID is not supported.
1958
1959 **/
1960 BOOLEAN
1961 Ikev2IsSupportAlg (
1962   IN UINT16 AlgorithmId,
1963   IN UINT8  Type
1964   )
1965 {
1966   UINT8 Index;
1967   switch (Type) {
1968   case IKE_ENCRYPT_TYPE :
1969     for (Index = 0; Index < IKEV2_SUPPORT_ENCRYPT_ALGORITHM_NUM; Index++) {
1970       if (mIkev2EncryptAlgorithmList[Index] == AlgorithmId) {
1971         return TRUE;
1972       }
1973     }
1974     break;
1975
1976   case IKE_AUTH_TYPE :
1977     for (Index = 0; Index < IKEV2_SUPPORT_AUTH_ALGORITHM_NUM; Index++) {
1978       if (mIkev2AuthAlgorithmList[Index] == AlgorithmId) {
1979         return TRUE;
1980       }
1981     }
1982     break;
1983
1984   case IKE_DH_TYPE :
1985     for (Index = 0; Index < IKEV2_SUPPORT_DH_ALGORITHM_NUM; Index++) {
1986       if (mIkev2DhGroupAlgorithmList[Index] == AlgorithmId) {
1987         return TRUE;
1988       }
1989     }
1990     break;
1991
1992   case IKE_PRF_TYPE :
1993     for (Index = 0; Index < IKEV2_SUPPORT_PRF_ALGORITHM_NUM; Index++) {
1994       if (mIkev2PrfAlgorithmList[Index] == AlgorithmId) {
1995         return TRUE;
1996       }
1997     }
1998   }
1999   return FALSE;
2000 }
2001
2002 /**
2003   Get the preferred algorithm types from ProposalData.
2004
2005   @param[in]  ProposalData              Pointer to related IKEV2_PROPOSAL_DATA.
2006   @param[out] PreferEncryptAlgorithm    Output of preferred encrypt algorithm.
2007   @param[out] PreferIntegrityAlgorithm  Output of preferred integrity algorithm.
2008   @param[out] PreferPrfAlgorithm        Output of preferred PRF algorithm. Only
2009                                         for IKE SA.
2010   @param[out] PreferDhGroup             Output of preferred DH group. Only for
2011                                         IKE SA.
2012   @param[out] PreferEncryptKeylength    Output of preferred encrypt key length
2013                                         in bytes.
2014   @param[out] IsSupportEsn              Output of value about the Extented Sequence
2015                                         Number is support or not. Only for Child SA.
2016   @param[in]  IsChildSa                 If it is ture, the ProposalData is for IKE
2017                                         SA. Otherwise the proposalData is for Child SA.
2018
2019 **/
2020 VOID
2021 Ikev2ParseProposalData (
2022   IN     IKEV2_PROPOSAL_DATA  *ProposalData,
2023      OUT UINT16               *PreferEncryptAlgorithm,
2024      OUT UINT16               *PreferIntegrityAlgorithm,
2025      OUT UINT16               *PreferPrfAlgorithm,
2026      OUT UINT16               *PreferDhGroup,
2027      OUT UINTN                *PreferEncryptKeylength,
2028      OUT BOOLEAN              *IsSupportEsn,
2029   IN     BOOLEAN              IsChildSa
2030 )
2031 {
2032   IKEV2_TRANSFORM_DATA *TransformData;
2033   UINT8                TransformIndex;
2034
2035   //
2036   // Check input parameters.
2037   //
2038   if (ProposalData == NULL ||
2039       PreferEncryptAlgorithm == NULL ||
2040       PreferIntegrityAlgorithm == NULL ||
2041       PreferEncryptKeylength == NULL
2042       ) {
2043     return;
2044   }
2045
2046   if (IsChildSa) {
2047     if (IsSupportEsn == NULL) {
2048       return;
2049     }
2050   } else {
2051     if (PreferPrfAlgorithm == NULL || PreferDhGroup == NULL) {
2052       return;
2053     }
2054   }
2055
2056   TransformData = (IKEV2_TRANSFORM_DATA *)(ProposalData + 1);
2057   for (TransformIndex = 0; TransformIndex < ProposalData->NumTransforms; TransformIndex++) {
2058     switch (TransformData->TransformType) {
2059     //
2060     // For IKE SA there are four algorithm types. Encryption Algorithm, Pseudo-random Function,
2061     // Integrity Algorithm, Diffie-Hellman Group. For Child SA, there are three algorithm types.
2062     // Encryption Algorithm, Integrity Algorithm, Extended Sequence Number.
2063     //
2064     case IKEV2_TRANSFORM_TYPE_ENCR:
2065       if (*PreferEncryptAlgorithm == 0 && Ikev2IsSupportAlg (TransformData->TransformId, IKE_ENCRYPT_TYPE)) {
2066         //
2067         // Check the attribute value. According to RFC, only Keylength is support.
2068         //
2069         if (TransformData->Attribute.AttrType == IKEV2_ATTRIBUTE_TYPE_KEYLEN) {
2070           //
2071           // If the Keylength is not support, continue to check the next one.
2072           //
2073           if (IpSecGetEncryptKeyLength ((UINT8)TransformData->TransformId) != (UINTN)(TransformData->Attribute.Attr.AttrValue >> 3)){
2074             break;
2075           } else {
2076             *PreferEncryptKeylength = TransformData->Attribute.Attr.AttrValue;
2077           }
2078         }
2079         *PreferEncryptAlgorithm = TransformData->TransformId;
2080       }
2081       break;
2082
2083     case IKEV2_TRANSFORM_TYPE_PRF :
2084       if (!IsChildSa) {
2085         if (*PreferPrfAlgorithm == 0 && Ikev2IsSupportAlg (TransformData->TransformId, IKE_PRF_TYPE)) {
2086           *PreferPrfAlgorithm = TransformData->TransformId;
2087         }
2088       }
2089       break;
2090
2091     case IKEV2_TRANSFORM_TYPE_INTEG :
2092       if (*PreferIntegrityAlgorithm == 0 && Ikev2IsSupportAlg (TransformData->TransformId, IKE_AUTH_TYPE)) {
2093         *PreferIntegrityAlgorithm = TransformData->TransformId;
2094       }
2095       break;
2096
2097     case IKEV2_TRANSFORM_TYPE_DH :
2098       if (!IsChildSa) {
2099         if (*PreferDhGroup == 0 && Ikev2IsSupportAlg (TransformData->TransformId, IKE_DH_TYPE)) {
2100           *PreferDhGroup = TransformData->TransformId;
2101         }
2102       }
2103       break;
2104
2105     case IKEV2_TRANSFORM_TYPE_ESN :
2106       if (IsChildSa) {
2107         if (TransformData->TransformId != 0) {
2108           *IsSupportEsn = TRUE;
2109         }
2110       }
2111       break;
2112
2113     default:
2114       break;
2115     }
2116     TransformData = (IKEV2_TRANSFORM_DATA *)(TransformData + 1);
2117   }
2118 }
2119
2120 /**
2121   Parse the received Initial Exchange Packet.
2122
2123   This function parse the SA Payload and Key Payload to find out the cryptographic
2124   suite for the further IKE negotiation and fill it into the IKE SA Session's
2125   CommonSession->SaParams.
2126
2127   @param[in, out]  IkeSaSession  Pointer to related IKEV2_SA_SESSION.
2128   @param[in]       SaPayload     The received packet.
2129   @param[in]       Type          The received packet IKE header flag.
2130
2131   @retval          TRUE          If the SA proposal in Packet is acceptable.
2132   @retval          FALSE         If the SA proposal in Packet is not acceptable.
2133
2134 **/
2135 BOOLEAN
2136 Ikev2SaParseSaPayload (
2137   IN OUT IKEV2_SA_SESSION *IkeSaSession,
2138   IN     IKE_PAYLOAD      *SaPayload,
2139   IN     UINT8            Type
2140   )
2141 {
2142   IKEV2_PROPOSAL_DATA  *ProposalData;
2143   UINT8                ProposalIndex;
2144   UINT16               PreferEncryptAlgorithm;
2145   UINT16               PreferIntegrityAlgorithm;
2146   UINT16               PreferPrfAlgorithm;
2147   UINT16               PreferDhGroup;
2148   UINTN                PreferEncryptKeylength;
2149   UINT16               EncryptAlgorithm;
2150   UINT16               IntegrityAlgorithm;
2151   UINT16               PrfAlgorithm;
2152   UINT16               DhGroup;
2153   UINTN                EncryptKeylength;
2154   BOOLEAN              IsMatch;
2155   UINTN                SaDataSize;
2156
2157   PreferPrfAlgorithm       = 0;
2158   PreferIntegrityAlgorithm = 0;
2159   PreferDhGroup            = 0;
2160   PreferEncryptAlgorithm   = 0;
2161   PreferEncryptKeylength   = 0;
2162   PrfAlgorithm             = 0;
2163   IntegrityAlgorithm       = 0;
2164   DhGroup                  = 0;
2165   EncryptAlgorithm         = 0;
2166   EncryptKeylength         = 0;
2167   IsMatch                  = FALSE;
2168
2169   if (Type == IKE_HEADER_FLAGS_INIT) {
2170     ProposalData   = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *)SaPayload->PayloadBuf + 1);
2171     for (ProposalIndex = 0; ProposalIndex < ((IKEV2_SA_DATA *)SaPayload->PayloadBuf)->NumProposals; ProposalIndex++) {
2172       //
2173       // Iterate each proposal to find the perfered one.
2174       //
2175       if (ProposalData->ProtocolId == IPSEC_PROTO_ISAKMP && ProposalData->NumTransforms >= 4) {
2176         //
2177         // Get the preferred algorithms.
2178         //
2179         Ikev2ParseProposalData (
2180           ProposalData,
2181           &PreferEncryptAlgorithm,
2182           &PreferIntegrityAlgorithm,
2183           &PreferPrfAlgorithm,
2184           &PreferDhGroup,
2185           &PreferEncryptKeylength,
2186           NULL,
2187           FALSE
2188           );
2189
2190         if (PreferEncryptAlgorithm != 0 &&
2191               PreferIntegrityAlgorithm != 0 &&
2192               PreferPrfAlgorithm != 0 &&
2193               PreferDhGroup != 0
2194               ) {
2195             //
2196             // Find the matched one.
2197             //
2198             IkeSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));
2199             ASSERT (IkeSaSession->SessionCommon.SaParams != NULL);
2200             IkeSaSession->SessionCommon.SaParams->EncAlgId   = PreferEncryptAlgorithm;
2201             IkeSaSession->SessionCommon.SaParams->EnckeyLen  = PreferEncryptKeylength;
2202             IkeSaSession->SessionCommon.SaParams->DhGroup    = PreferDhGroup;
2203             IkeSaSession->SessionCommon.SaParams->Prf        = PreferPrfAlgorithm;
2204             IkeSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;
2205             IkeSaSession->SessionCommon.PreferDhGroup        = PreferDhGroup;
2206
2207             //
2208             // Save the matched one in IKEV2_SA_DATA for furthure calculation.
2209             //
2210             SaDataSize           = sizeof (IKEV2_SA_DATA) +
2211                                    sizeof (IKEV2_PROPOSAL_DATA) +
2212                                    sizeof (IKEV2_TRANSFORM_DATA) * 4;
2213             IkeSaSession->SaData = AllocateZeroPool (SaDataSize);
2214             ASSERT (IkeSaSession->SaData != NULL);
2215
2216             IkeSaSession->SaData->NumProposals  = 1;
2217
2218             //
2219             // BUGBUG: Suppose the matched proposal only has 4 transforms. If
2220             // The matched Proposal has more than 4 transforms means it contains
2221             // one than one transform with same type.
2222             //
2223             CopyMem (
2224               (IKEV2_PROPOSAL_DATA *) (IkeSaSession->SaData + 1),
2225                ProposalData,
2226                SaDataSize - sizeof (IKEV2_SA_DATA)
2227               );
2228
2229             ((IKEV2_PROPOSAL_DATA *) (IkeSaSession->SaData + 1))->ProposalIndex = 1;
2230             return TRUE;
2231           } else {
2232             PreferEncryptAlgorithm   = 0;
2233             PreferIntegrityAlgorithm = 0;
2234             PreferPrfAlgorithm       = 0;
2235             PreferDhGroup            = 0;
2236             PreferEncryptKeylength   = 0;
2237           }
2238       }
2239       //
2240       // Point to next Proposal.
2241       //
2242       ProposalData = (IKEV2_PROPOSAL_DATA*)((UINT8*)(ProposalData + 1) +
2243                      ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));
2244     }
2245   } else if (Type == IKE_HEADER_FLAGS_RESPOND) {
2246     //
2247     // First check the SA proposal's ProtoctolID and Transform Numbers. Since it is
2248     // the responded SA proposal, suppose it only has one proposal and the transform Numbers
2249     // is 4.
2250     //
2251     ProposalData  = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *) SaPayload->PayloadBuf + 1);
2252     if (ProposalData->ProtocolId != IPSEC_PROTO_ISAKMP || ProposalData->NumTransforms != 4) {
2253       return FALSE;
2254     }
2255     //
2256     // Get the preferred algorithms.
2257     //
2258     Ikev2ParseProposalData (
2259       ProposalData,
2260       &PreferEncryptAlgorithm,
2261       &PreferIntegrityAlgorithm,
2262       &PreferPrfAlgorithm,
2263       &PreferDhGroup,
2264       &PreferEncryptKeylength,
2265       NULL,
2266       FALSE
2267       );
2268     //
2269     // Check if the Sa proposal data from received packet is in the IkeSaSession->SaData.
2270     //
2271     ProposalData = (IKEV2_PROPOSAL_DATA *) (IkeSaSession->SaData + 1);
2272
2273     for (ProposalIndex = 0; ProposalIndex < IkeSaSession->SaData->NumProposals && (!IsMatch); ProposalIndex++) {
2274       Ikev2ParseProposalData (
2275           ProposalData,
2276           &EncryptAlgorithm,
2277           &IntegrityAlgorithm,
2278           &PrfAlgorithm,
2279           &DhGroup,
2280           &EncryptKeylength,
2281           NULL,
2282           FALSE
2283           );
2284       if (EncryptAlgorithm == PreferEncryptAlgorithm &&
2285           EncryptKeylength == PreferEncryptKeylength &&
2286           IntegrityAlgorithm == PreferIntegrityAlgorithm &&
2287           PrfAlgorithm == PreferPrfAlgorithm &&
2288           DhGroup      == PreferDhGroup
2289           ) {
2290         IsMatch = TRUE;
2291       } else {
2292         EncryptAlgorithm   = 0;
2293         IntegrityAlgorithm = 0;
2294         PrfAlgorithm       = 0;
2295         DhGroup            = 0;
2296         EncryptKeylength   = 0;
2297       }
2298
2299       ProposalData = (IKEV2_PROPOSAL_DATA*)((UINT8*)(ProposalData + 1) +
2300                      ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));
2301     }
2302
2303     if (IsMatch) {
2304         IkeSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));
2305         ASSERT (IkeSaSession->SessionCommon.SaParams != NULL);
2306         IkeSaSession->SessionCommon.SaParams->EncAlgId   = PreferEncryptAlgorithm;
2307         IkeSaSession->SessionCommon.SaParams->EnckeyLen  = PreferEncryptKeylength;
2308         IkeSaSession->SessionCommon.SaParams->DhGroup    = PreferDhGroup;
2309         IkeSaSession->SessionCommon.SaParams->Prf        = PreferPrfAlgorithm;
2310         IkeSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;
2311         IkeSaSession->SessionCommon.PreferDhGroup        = PreferDhGroup;
2312
2313         return TRUE;
2314     }
2315   }
2316   return FALSE;
2317 }
2318
2319 /**
2320   Parse the received Authentication Exchange Packet.
2321
2322   This function parse the SA Payload and Key Payload to find out the cryptographic
2323   suite for the ESP and fill it into the Child SA Session's CommonSession->SaParams.
2324
2325   @param[in, out]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION related to
2326                                    this Authentication Exchange.
2327   @param[in]       SaPayload       The received packet.
2328   @param[in]       Type            The IKE header's flag of received packet .
2329
2330   @retval          TRUE            If the SA proposal in Packet is acceptable.
2331   @retval          FALSE           If the SA proposal in Packet is not acceptable.
2332
2333 **/
2334 BOOLEAN
2335 Ikev2ChildSaParseSaPayload (
2336   IN OUT IKEV2_CHILD_SA_SESSION *ChildSaSession,
2337   IN     IKE_PAYLOAD            *SaPayload,
2338   IN     UINT8                  Type
2339   )
2340 {
2341   IKEV2_PROPOSAL_DATA  *ProposalData;
2342   UINT8                ProposalIndex;
2343   UINT16               PreferEncryptAlgorithm;
2344   UINT16               PreferIntegrityAlgorithm;
2345   UINTN                PreferEncryptKeylength;
2346   BOOLEAN              PreferIsSupportEsn;
2347   UINT16               EncryptAlgorithm;
2348   UINT16               IntegrityAlgorithm;
2349   UINTN                EncryptKeylength;
2350   BOOLEAN              IsSupportEsn;
2351   BOOLEAN              IsMatch;
2352   UINTN                SaDataSize;
2353
2354
2355   PreferIntegrityAlgorithm = 0;
2356   PreferEncryptAlgorithm   = 0;
2357   PreferEncryptKeylength   = 0;
2358   IntegrityAlgorithm       = 0;
2359   EncryptAlgorithm         = 0;
2360   EncryptKeylength         = 0;
2361   IsMatch                  = TRUE;
2362   IsSupportEsn             = FALSE;
2363   PreferIsSupportEsn       = FALSE;
2364
2365   if (Type == IKE_HEADER_FLAGS_INIT) {
2366     ProposalData   = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *) SaPayload->PayloadBuf + 1);
2367     for (ProposalIndex = 0; ProposalIndex < ((IKEV2_SA_DATA *) SaPayload->PayloadBuf)->NumProposals; ProposalIndex++) {
2368       //
2369       // Iterate each proposal to find the preferred one.
2370       //
2371       if (ProposalData->ProtocolId == IPSEC_PROTO_IPSEC_ESP && ProposalData->NumTransforms >= 3) {
2372         //
2373         // Get the preferred algorithm.
2374         //
2375         Ikev2ParseProposalData (
2376           ProposalData,
2377           &PreferEncryptAlgorithm,
2378           &PreferIntegrityAlgorithm,
2379           NULL,
2380           NULL,
2381           &PreferEncryptKeylength,
2382           &IsSupportEsn,
2383           TRUE
2384           );
2385         //
2386         // Don't support the ESN now.
2387         //
2388         if (PreferEncryptAlgorithm != 0 &&
2389             PreferIntegrityAlgorithm != 0 &&
2390             !IsSupportEsn
2391             ) {
2392           //
2393           // Find the matched one.
2394           //
2395           ChildSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));
2396           ASSERT (ChildSaSession->SessionCommon.SaParams != NULL);
2397           ChildSaSession->SessionCommon.SaParams->EncAlgId   = PreferEncryptAlgorithm;
2398           ChildSaSession->SessionCommon.SaParams->EnckeyLen  = PreferEncryptKeylength;
2399           ChildSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;
2400           CopyMem (&ChildSaSession->RemotePeerSpi, ProposalData->Spi, sizeof (ChildSaSession->RemotePeerSpi));
2401
2402           //
2403           // Save the matched one in IKEV2_SA_DATA for furthure calculation.
2404           //
2405           SaDataSize           = sizeof (IKEV2_SA_DATA) +
2406                                  sizeof (IKEV2_PROPOSAL_DATA) +
2407                                  sizeof (IKEV2_TRANSFORM_DATA) * 4;
2408
2409           ChildSaSession->SaData = AllocateZeroPool (SaDataSize);
2410           ASSERT (ChildSaSession->SaData != NULL);
2411
2412           ChildSaSession->SaData->NumProposals  = 1;
2413
2414           //
2415           // BUGBUG: Suppose there are 4 transforms in the matched proposal. If
2416           // the matched Proposal has more than 4 transforms that means there
2417           // are more than one transform with same type.
2418           //
2419           CopyMem (
2420             (IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1),
2421              ProposalData,
2422              SaDataSize - sizeof (IKEV2_SA_DATA)
2423             );
2424
2425           ((IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1))->ProposalIndex = 1;
2426
2427           ((IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1))->Spi = AllocateCopyPool (
2428                                                                           sizeof (ChildSaSession->LocalPeerSpi),
2429                                                                           &ChildSaSession->LocalPeerSpi
2430                                                                           );
2431           ASSERT (((IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1))->Spi != NULL);
2432           return TRUE;
2433
2434         } else {
2435           PreferEncryptAlgorithm   = 0;
2436           PreferIntegrityAlgorithm = 0;
2437           IsSupportEsn             = TRUE;
2438         }
2439       }
2440       //
2441       // Point to next Proposal
2442       //
2443       ProposalData = (IKEV2_PROPOSAL_DATA *)((UINT8 *)(ProposalData + 1) +
2444                      ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));
2445     }
2446   } else if (Type == IKE_HEADER_FLAGS_RESPOND) {
2447     //
2448     // First check the SA proposal's ProtoctolID and Transform Numbers. Since it is
2449     // the responded SA proposal, suppose it only has one proposal and the transform Numbers
2450     // is 3.
2451     //
2452     ProposalData  = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *)SaPayload->PayloadBuf + 1);
2453     if (ProposalData->ProtocolId != IPSEC_PROTO_IPSEC_ESP || ProposalData->NumTransforms != 3) {
2454       return FALSE;
2455     }
2456     //
2457     // Get the preferred algorithms.
2458     //
2459     Ikev2ParseProposalData (
2460       ProposalData,
2461       &PreferEncryptAlgorithm,
2462       &PreferIntegrityAlgorithm,
2463       NULL,
2464       NULL,
2465       &PreferEncryptKeylength,
2466       &PreferIsSupportEsn,
2467       TRUE
2468       );
2469
2470     ProposalData = (IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1);
2471
2472     for (ProposalIndex = 0; ProposalIndex < ChildSaSession->SaData->NumProposals && (!IsMatch); ProposalIndex++) {
2473       Ikev2ParseProposalData (
2474           ProposalData,
2475           &EncryptAlgorithm,
2476           &IntegrityAlgorithm,
2477           NULL,
2478           NULL,
2479           &EncryptKeylength,
2480           &IsSupportEsn,
2481           TRUE
2482           );
2483       if (EncryptAlgorithm == PreferEncryptAlgorithm &&
2484           EncryptKeylength == PreferEncryptKeylength &&
2485           IntegrityAlgorithm == PreferIntegrityAlgorithm &&
2486           IsSupportEsn == PreferIsSupportEsn
2487           ) {
2488         IsMatch = TRUE;
2489       } else {
2490         PreferEncryptAlgorithm   = 0;
2491         PreferIntegrityAlgorithm = 0;
2492         IsSupportEsn             = TRUE;
2493       }
2494        ProposalData = (IKEV2_PROPOSAL_DATA*)((UINT8*)(ProposalData + 1) +
2495                      ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));
2496     }
2497
2498     ProposalData  = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *)SaPayload->PayloadBuf + 1);
2499     if (IsMatch) {
2500         ChildSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));
2501         ASSERT (ChildSaSession->SessionCommon.SaParams != NULL);
2502         ChildSaSession->SessionCommon.SaParams->EncAlgId   = PreferEncryptAlgorithm;
2503         ChildSaSession->SessionCommon.SaParams->EnckeyLen  = PreferEncryptKeylength;
2504         ChildSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;
2505         CopyMem (&ChildSaSession->RemotePeerSpi, ProposalData->Spi, sizeof (ChildSaSession->RemotePeerSpi));
2506
2507         return TRUE;
2508     }
2509   }
2510   return FALSE;
2511 }
2512
2513 /**
2514   Generate Key buffer from fragments.
2515
2516   If the digest length of specified HashAlgId is larger than or equal with the
2517   required output key length, derive the key directly. Otherwise, Key Material
2518   needs to be PRF-based concatenation according to 2.13 of RFC 4306:
2519   prf+ (K,S) = T1 | T2 | T3 | T4 | ..., T1 = prf (K, S | 0x01),
2520   T2 = prf (K, T1 | S | 0x02), T3 = prf (K, T2 | S | 0x03),T4 = prf (K, T3 | S | 0x04)
2521   then derive the key from this key material.
2522
2523   @param[in]       HashAlgId        The Hash Algorithm ID used to generate key.
2524   @param[in]       HashKey          Pointer to a key buffer which contains hash key.
2525   @param[in]       HashKeyLength    The length of HashKey in bytes.
2526   @param[in, out]  OutputKey        Pointer to buffer which is used to receive the
2527                                     output key.
2528   @param[in]       OutputKeyLength  The length of OutPutKey buffer.
2529   @param[in]       Fragments        Pointer to the data to be used to generate key.
2530   @param[in]       NumFragments     The numbers of the Fragement.
2531
2532   @retval EFI_SUCCESS            The operation complete successfully.
2533   @retval EFI_INVALID_PARAMETER  If NumFragments is zero.
2534   @retval EFI_OUT_OF_RESOURCES   If the required resource can't be allocated.
2535   @retval Others                 The operation is failed.
2536
2537 **/
2538 EFI_STATUS
2539 Ikev2SaGenerateKey (
2540   IN     UINT8                 HashAlgId,
2541   IN     UINT8                 *HashKey,
2542   IN     UINTN                 HashKeyLength,
2543   IN OUT UINT8                 *OutputKey,
2544   IN     UINTN                 OutputKeyLength,
2545   IN     PRF_DATA_FRAGMENT    *Fragments,
2546   IN     UINTN                 NumFragments
2547   )
2548 {
2549   EFI_STATUS          Status;
2550   PRF_DATA_FRAGMENT   LocalFragments[3];
2551   UINT8               *Digest;
2552   UINTN               DigestSize;
2553   UINTN               Round;
2554   UINTN               Index;
2555   UINTN               AuthKeyLength;
2556   UINTN               FragmentsSize;
2557   UINT8               TailData;
2558
2559   Status = EFI_SUCCESS;
2560
2561   if (NumFragments == 0) {
2562     return EFI_INVALID_PARAMETER;
2563   }
2564
2565   LocalFragments[0].Data = NULL;
2566   LocalFragments[1].Data = NULL;
2567   LocalFragments[2].Data = NULL;
2568
2569   AuthKeyLength = IpSecGetHmacDigestLength (HashAlgId);
2570   DigestSize    = AuthKeyLength;
2571   Digest        = AllocateZeroPool (AuthKeyLength);
2572
2573   if (Digest == NULL) {
2574     return EFI_OUT_OF_RESOURCES;
2575   }
2576   //
2577   // If the required output key length is less than the digest size,
2578   // copy the digest into OutputKey.
2579   //
2580   if (OutputKeyLength <=  DigestSize) {
2581     Status = IpSecCryptoIoHmac (
2582                HashAlgId,
2583                HashKey,
2584                HashKeyLength,
2585                (HASH_DATA_FRAGMENT *) Fragments,
2586                NumFragments,
2587                Digest,
2588                DigestSize
2589                );
2590     if (EFI_ERROR (Status)) {
2591       goto Exit;
2592     }
2593
2594     CopyMem (OutputKey, Digest, OutputKeyLength);
2595     goto Exit;
2596   }
2597
2598   //
2599   //Otherwise, Key Material need to be PRF-based concatenation according to 2.13
2600   //of RFC 4306: prf+ (K,S) = T1 | T2 | T3 | T4 | ..., T1 = prf (K, S | 0x01),
2601   //T2 = prf (K, T1 | S | 0x02), T3 = prf (K, T2 | S | 0x03),T4 = prf (K, T3 | S | 0x04)
2602   //then derive the key from this key material.
2603   //
2604   FragmentsSize = 0;
2605   for (Index = 0; Index < NumFragments; Index++) {
2606     FragmentsSize = FragmentsSize + Fragments[Index].DataSize;
2607   }
2608
2609   LocalFragments[1].Data     = AllocateZeroPool (FragmentsSize);
2610   ASSERT (LocalFragments[1].Data != NULL);
2611   LocalFragments[1].DataSize = FragmentsSize;
2612
2613   //
2614   // Copy all input fragments into LocalFragments[1];
2615   //
2616   FragmentsSize = 0;
2617   for (Index = 0; Index < NumFragments; Index++) {
2618     CopyMem (
2619       LocalFragments[1].Data + FragmentsSize,
2620       Fragments[Index].Data,
2621       Fragments[Index].DataSize
2622       );
2623     FragmentsSize = FragmentsSize + Fragments[Index].DataSize;
2624   }
2625
2626   //
2627   // Prepare 0x01 as the first tail data.
2628   //
2629   TailData                   = 0x01;
2630   LocalFragments[2].Data     = &TailData;
2631   LocalFragments[2].DataSize = sizeof (TailData);
2632   //
2633   // Allocate buffer for the first fragment
2634   //
2635   LocalFragments[0].Data     = AllocateZeroPool (AuthKeyLength);
2636   ASSERT (LocalFragments[0].Data != NULL);
2637   LocalFragments[0].DataSize = AuthKeyLength;
2638
2639   Round = (OutputKeyLength - 1) / AuthKeyLength + 1;
2640   for (Index = 0; Index < Round; Index++) {
2641     Status = IpSecCryptoIoHmac (
2642                HashAlgId,
2643                HashKey,
2644                HashKeyLength,
2645                (HASH_DATA_FRAGMENT *)(Index == 0 ? &LocalFragments[1] : LocalFragments),
2646                Index == 0 ? 2 : 3,
2647                Digest,
2648                DigestSize
2649                );
2650     if (EFI_ERROR(Status)) {
2651       goto Exit;
2652     }
2653     CopyMem (
2654       LocalFragments[0].Data,
2655       Digest,
2656       DigestSize
2657       );
2658     if (OutputKeyLength > DigestSize * (Index + 1)) {
2659       CopyMem (
2660         OutputKey + Index * DigestSize,
2661         Digest,
2662         DigestSize
2663         );
2664       LocalFragments[0].DataSize = DigestSize;
2665       TailData ++;
2666     } else {
2667       //
2668       // The last round
2669       //
2670       CopyMem (
2671         OutputKey + Index * DigestSize,
2672         Digest,
2673         OutputKeyLength - Index * DigestSize
2674       );
2675     }
2676   }
2677
2678 Exit:
2679   //
2680   // Only First and second Framgement Data need to be freed.
2681   //
2682   for (Index = 0 ; Index < 2; Index++) {
2683     if (LocalFragments[Index].Data != NULL) {
2684       FreePool (LocalFragments[Index].Data);
2685     }
2686   }
2687   if (Digest != NULL) {
2688     FreePool (Digest);
2689   }
2690   return Status;
2691 }
2692