2 The implementation of IPSEC_CONFIG_PROTOCOL.
4 Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
6 This program and the accompanying materials
7 are licensed and made available under the terms and conditions of the BSD License
8 which accompanies this distribution. The full text of the license may be found at
9 http://opensource.org/licenses/bsd-license.php.
11 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
12 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
16 #include "IpSecConfigImpl.h"
17 #include "IpSecDebug.h"
19 LIST_ENTRY mConfigData
[IPsecConfigDataTypeMaximum
];
20 BOOLEAN mSetBySelf
= FALSE
;
23 // Common CompareSelector routine entry for SPD/SAD/PAD.
25 IPSEC_COMPARE_SELECTOR mCompareSelector
[] = {
26 (IPSEC_COMPARE_SELECTOR
) CompareSpdSelector
,
27 (IPSEC_COMPARE_SELECTOR
) CompareSaId
,
28 (IPSEC_COMPARE_SELECTOR
) ComparePadId
32 // Common IsZeroSelector routine entry for SPD/SAD/PAD.
34 IPSEC_IS_ZERO_SELECTOR mIsZeroSelector
[] = {
35 (IPSEC_IS_ZERO_SELECTOR
) IsZeroSpdSelector
,
36 (IPSEC_IS_ZERO_SELECTOR
) IsZeroSaId
,
37 (IPSEC_IS_ZERO_SELECTOR
) IsZeroPadId
41 // Common DuplicateSelector routine entry for SPD/SAD/PAD.
43 IPSEC_DUPLICATE_SELECTOR mDuplicateSelector
[] = {
44 (IPSEC_DUPLICATE_SELECTOR
) DuplicateSpdSelector
,
45 (IPSEC_DUPLICATE_SELECTOR
) DuplicateSaId
,
46 (IPSEC_DUPLICATE_SELECTOR
) DuplicatePadId
50 // Common FixPolicyEntry routine entry for SPD/SAD/PAD.
52 IPSEC_FIX_POLICY_ENTRY mFixPolicyEntry
[] = {
53 (IPSEC_FIX_POLICY_ENTRY
) FixSpdEntry
,
54 (IPSEC_FIX_POLICY_ENTRY
) FixSadEntry
,
55 (IPSEC_FIX_POLICY_ENTRY
) FixPadEntry
59 // Common UnfixPolicyEntry routine entry for SPD/SAD/PAD.
61 IPSEC_FIX_POLICY_ENTRY mUnfixPolicyEntry
[] = {
62 (IPSEC_FIX_POLICY_ENTRY
) UnfixSpdEntry
,
63 (IPSEC_FIX_POLICY_ENTRY
) UnfixSadEntry
,
64 (IPSEC_FIX_POLICY_ENTRY
) UnfixPadEntry
68 // Common SetPolicyEntry routine entry for SPD/SAD/PAD.
70 IPSEC_SET_POLICY_ENTRY mSetPolicyEntry
[] = {
71 (IPSEC_SET_POLICY_ENTRY
) SetSpdEntry
,
72 (IPSEC_SET_POLICY_ENTRY
) SetSadEntry
,
73 (IPSEC_SET_POLICY_ENTRY
) SetPadEntry
77 // Common GetPolicyEntry routine entry for SPD/SAD/PAD.
79 IPSEC_GET_POLICY_ENTRY mGetPolicyEntry
[] = {
80 (IPSEC_GET_POLICY_ENTRY
) GetSpdEntry
,
81 (IPSEC_GET_POLICY_ENTRY
) GetSadEntry
,
82 (IPSEC_GET_POLICY_ENTRY
) GetPadEntry
86 // Routine entry for IpSecConfig protocol.
88 EFI_IPSEC_CONFIG_PROTOCOL mIpSecConfigInstance
= {
89 EfiIpSecConfigSetData
,
90 EfiIpSecConfigGetData
,
91 EfiIpSecConfigGetNextSelector
,
92 EfiIpSecConfigRegisterNotify
,
93 EfiIpSecConfigUnregisterNotify
97 Get the all IPSec configuration variables and store those variables
98 to the internal data structure.
100 This founction is called by IpSecConfigInitialize() that is to intialize the
101 IPsecConfiguration Protocol.
103 @param[in] Private Point to IPSEC_PRIVATE_DATA.
105 @retval EFI_OUT_OF_RESOURCES The required system resource could not be allocated.
106 @retval EFI_SUCCESS Restore the IPsec Configuration successfully.
107 @retval others Other errors is found during the variable getting.
112 IN IPSEC_PRIVATE_DATA
*Private
116 Check if the specified EFI_IP_ADDRESS_INFO is in EFI_IP_ADDRESS_INFO list.
118 @param[in] AddressInfo Pointer of IP_ADDRESS_INFO to be search in AddressInfo list.
119 @param[in] AddressInfoList A list that contains IP_ADDRESS_INFOs.
120 @param[in] AddressCount Point out how many IP_ADDRESS_INFO in the list.
122 @retval TRUE The specified AddressInfo is in the AddressInfoList.
123 @retval FALSE The specified AddressInfo is not in the AddressInfoList.
128 IN EFI_IP_ADDRESS_INFO
*AddressInfo
,
129 IN EFI_IP_ADDRESS_INFO
*AddressInfoList
,
130 IN UINT32 AddressCount
134 EFI_IP_ADDRESS ZeroAddress
;
136 ZeroMem(&ZeroAddress
, sizeof (EFI_IP_ADDRESS
));
139 // Zero Address means any address is matched.
141 if (AddressCount
== 1) {
143 &AddressInfoList
[0].Address
,
145 sizeof (EFI_IP_ADDRESS
)
150 for (Index
= 0; Index
< AddressCount
; Index
++) {
153 &AddressInfoList
[Index
].Address
,
154 sizeof (EFI_IP_ADDRESS
)
156 AddressInfo
->PrefixLength
== AddressInfoList
[Index
].PrefixLength
165 Compare two SPD Selectors.
167 Compare two SPD Selector by the fields of LocalAddressCount/RemoteAddressCount/
168 NextLayerProtocol/LocalPort/LocalPortRange/RemotePort/RemotePortRange and the
169 Local Addresses and remote Addresses.
171 @param[in] Selector1 Pointer of first SPD Selector.
172 @param[in] Selector2 Pointer of second SPD Selector.
174 @retval TRUE This two Selector have the same value in above fields.
175 @retval FALSE Not all above fields have the same value in these two Selectors.
180 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector1
,
181 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector2
184 EFI_IPSEC_SPD_SELECTOR
*SpdSel1
;
185 EFI_IPSEC_SPD_SELECTOR
*SpdSel2
;
189 SpdSel1
= &Selector1
->SpdSelector
;
190 SpdSel2
= &Selector2
->SpdSelector
;
194 // Compare the LocalAddressCount/RemoteAddressCount/NextLayerProtocol/
195 // LocalPort/LocalPortRange/RemotePort/RemotePortRange fields in the
196 // two Spdselectors. Since the SPD supports two directions, it needs to
197 // compare two directions.
199 if ((SpdSel1
->LocalAddressCount
!= SpdSel2
->LocalAddressCount
&&
200 SpdSel1
->LocalAddressCount
!= SpdSel2
->RemoteAddressCount
) ||
201 (SpdSel1
->RemoteAddressCount
!= SpdSel2
->RemoteAddressCount
&&
202 SpdSel1
->RemoteAddressCount
!= SpdSel2
->LocalAddressCount
) ||
203 SpdSel1
->NextLayerProtocol
!= SpdSel2
->NextLayerProtocol
||
204 SpdSel1
->LocalPort
!= SpdSel2
->LocalPort
||
205 SpdSel1
->LocalPortRange
!= SpdSel2
->LocalPortRange
||
206 SpdSel1
->RemotePort
!= SpdSel2
->RemotePort
||
207 SpdSel1
->RemotePortRange
!= SpdSel2
->RemotePortRange
214 // Compare the all LocalAddress fields in the two Spdselectors.
215 // First, SpdSel1->LocalAddress to SpdSel2->LocalAddress && Compare
216 // SpdSel1->RemoteAddress to SpdSel2->RemoteAddress. If all match, return
219 for (Index
= 0; Index
< SpdSel1
->LocalAddressCount
; Index
++) {
220 if (!IsInAddressInfoList (
221 &SpdSel1
->LocalAddress
[Index
],
222 SpdSel2
->LocalAddress
,
223 SpdSel2
->LocalAddressCount
230 for (Index
= 0; Index
< SpdSel2
->LocalAddressCount
; Index
++) {
231 if (!IsInAddressInfoList (
232 &SpdSel2
->LocalAddress
[Index
],
233 SpdSel1
->LocalAddress
,
234 SpdSel1
->LocalAddressCount
242 for (Index
= 0; Index
< SpdSel1
->RemoteAddressCount
; Index
++) {
243 if (!IsInAddressInfoList (
244 &SpdSel1
->RemoteAddress
[Index
],
245 SpdSel2
->RemoteAddress
,
246 SpdSel2
->RemoteAddressCount
254 for (Index
= 0; Index
< SpdSel2
->RemoteAddressCount
; Index
++) {
255 if (!IsInAddressInfoList (
256 &SpdSel2
->RemoteAddress
[Index
],
257 SpdSel1
->RemoteAddress
,
258 SpdSel1
->RemoteAddressCount
266 // Finish the one direction compare. If it is matched, return; otherwise,
267 // compare the other direction.
273 // Secondly, the SpdSel1->LocalAddress doesn't equal to SpdSel2->LocalAddress and
274 // SpdSel1->RemoteAddress doesn't equal to SpdSel2->RemoteAddress. Try to compare
275 // the RemoteAddress to LocalAddress.
278 for (Index
= 0; Index
< SpdSel1
->RemoteAddressCount
; Index
++) {
279 if (!IsInAddressInfoList (
280 &SpdSel1
->RemoteAddress
[Index
],
281 SpdSel2
->LocalAddress
,
282 SpdSel2
->LocalAddressCount
289 for (Index
= 0; Index
< SpdSel2
->RemoteAddressCount
; Index
++) {
290 if (!IsInAddressInfoList (
291 &SpdSel2
->RemoteAddress
[Index
],
292 SpdSel1
->LocalAddress
,
293 SpdSel1
->LocalAddressCount
301 for (Index
= 0; Index
< SpdSel1
->LocalAddressCount
; Index
++) {
302 if (!IsInAddressInfoList (
303 &SpdSel1
->LocalAddress
[Index
],
304 SpdSel2
->RemoteAddress
,
305 SpdSel2
->RemoteAddressCount
313 for (Index
= 0; Index
< SpdSel2
->LocalAddressCount
; Index
++) {
314 if (!IsInAddressInfoList (
315 &SpdSel2
->LocalAddress
[Index
],
316 SpdSel1
->RemoteAddress
,
317 SpdSel1
->RemoteAddressCount
328 Find if the two SPD Selectors has subordinative.
330 Compare two SPD Selector by the fields of LocalAddressCount/RemoteAddressCount/
331 NextLayerProtocol/LocalPort/LocalPortRange/RemotePort/RemotePortRange and the
332 Local Addresses and remote Addresses.
334 @param[in] Selector1 Pointer of first SPD Selector.
335 @param[in] Selector2 Pointer of second SPD Selector.
337 @retval TRUE The first SPD Selector is subordinate Selector of second SPD Selector.
338 @retval FALSE The first SPD Selector is not subordinate Selector of second
344 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector1
,
345 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector2
348 EFI_IPSEC_SPD_SELECTOR
*SpdSel1
;
349 EFI_IPSEC_SPD_SELECTOR
*SpdSel2
;
353 SpdSel1
= &Selector1
->SpdSelector
;
354 SpdSel2
= &Selector2
->SpdSelector
;
358 // Compare the LocalAddressCount/RemoteAddressCount/NextLayerProtocol/
359 // LocalPort/LocalPortRange/RemotePort/RemotePortRange fields in the
360 // two Spdselectors. Since the SPD supports two directions, it needs to
361 // compare two directions.
363 if (SpdSel1
->LocalAddressCount
> SpdSel2
->LocalAddressCount
||
364 SpdSel1
->RemoteAddressCount
> SpdSel2
->RemoteAddressCount
||
365 (SpdSel1
->NextLayerProtocol
!= SpdSel2
->NextLayerProtocol
&& SpdSel2
->NextLayerProtocol
!= 0xffff) ||
366 (SpdSel1
->LocalPort
> SpdSel2
->LocalPort
&& SpdSel2
->LocalPort
!= 0)||
367 (SpdSel1
->LocalPortRange
> SpdSel2
->LocalPortRange
&& SpdSel1
->LocalPort
!= 0)||
368 (SpdSel1
->RemotePort
> SpdSel2
->RemotePort
&& SpdSel2
->RemotePort
!= 0) ||
369 (SpdSel1
->RemotePortRange
> SpdSel2
->RemotePortRange
&& SpdSel2
->RemotePort
!= 0)
375 // Compare the all LocalAddress fields in the two Spdselectors.
376 // First, SpdSel1->LocalAddress to SpdSel2->LocalAddress && Compare
377 // SpdSel1->RemoteAddress to SpdSel2->RemoteAddress. If all match, return
381 for (Index
= 0; Index
< SpdSel1
->LocalAddressCount
; Index
++) {
382 if (!IsInAddressInfoList (
383 &SpdSel1
->LocalAddress
[Index
],
384 SpdSel2
->LocalAddress
,
385 SpdSel2
->LocalAddressCount
393 for (Index
= 0; Index
< SpdSel1
->RemoteAddressCount
; Index
++) {
394 if (!IsInAddressInfoList (
395 &SpdSel1
->RemoteAddress
[Index
],
396 SpdSel2
->RemoteAddress
,
397 SpdSel2
->RemoteAddressCount
411 // The SPD selector in SPD entry is two way.
413 // Compare the LocalAddressCount/RemoteAddressCount/NextLayerProtocol/
414 // LocalPort/LocalPortRange/RemotePort/RemotePortRange fields in the
415 // two Spdselectors. Since the SPD supports two directions, it needs to
416 // compare two directions.
419 if (SpdSel1
->LocalAddressCount
> SpdSel2
->RemoteAddressCount
||
420 SpdSel1
->RemoteAddressCount
> SpdSel2
->LocalAddressCount
||
421 (SpdSel1
->NextLayerProtocol
!= SpdSel2
->NextLayerProtocol
&& SpdSel2
->NextLayerProtocol
!= 0xffff) ||
422 (SpdSel1
->LocalPort
> SpdSel2
->RemotePort
&& SpdSel2
->RemotePort
!= 0)||
423 (SpdSel1
->LocalPortRange
> SpdSel2
->RemotePortRange
&& SpdSel1
->RemotePort
!= 0)||
424 (SpdSel1
->RemotePort
> SpdSel2
->LocalPort
&& SpdSel2
->LocalPort
!= 0) ||
425 (SpdSel1
->RemotePortRange
> SpdSel2
->LocalPortRange
&& SpdSel2
->LocalPort
!= 0)
432 // Compare the all LocalAddress fields in the two Spdselectors.
433 // First, SpdSel1->LocalAddress to SpdSel2->LocalAddress && Compare
434 // SpdSel1->RemoteAddress to SpdSel2->RemoteAddress. If all match, return
437 for (Index
= 0; Index
< SpdSel1
->LocalAddressCount
; Index
++) {
438 if (!IsInAddressInfoList (
439 &SpdSel1
->LocalAddress
[Index
],
440 SpdSel2
->RemoteAddress
,
441 SpdSel2
->RemoteAddressCount
449 for (Index
= 0; Index
< SpdSel1
->RemoteAddressCount
; Index
++) {
450 if (!IsInAddressInfoList (
451 &SpdSel1
->RemoteAddress
[Index
],
452 SpdSel2
->LocalAddress
,
453 SpdSel2
->LocalAddressCount
467 @param[in] Selector1 Pointer of first SA ID.
468 @param[in] Selector2 Pointer of second SA ID.
470 @retval TRUE This two Selectors have the same SA ID.
471 @retval FALSE This two Selecotrs don't have the same SA ID.
476 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector1
,
477 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector2
480 EFI_IPSEC_SA_ID
*SaId1
;
481 EFI_IPSEC_SA_ID
*SaId2
;
484 SaId1
= &Selector1
->SaId
;
485 SaId2
= &Selector2
->SaId
;
488 if (CompareMem (SaId1
, SaId2
, sizeof (EFI_IPSEC_SA_ID
)) != 0) {
498 @param[in] Selector1 Pointer of first PAD ID.
499 @param[in] Selector2 Pointer of second PAD ID.
501 @retval TRUE This two Selectors have the same PAD ID.
502 @retval FALSE This two Selecotrs don't have the same PAD ID.
507 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector1
,
508 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector2
511 EFI_IPSEC_PAD_ID
*PadId1
;
512 EFI_IPSEC_PAD_ID
*PadId2
;
515 PadId1
= &Selector1
->PadId
;
516 PadId2
= &Selector2
->PadId
;
520 // Compare the PeerIdValid fields in PadId.
522 if (PadId1
->PeerIdValid
!= PadId2
->PeerIdValid
) {
526 // Compare the PeerId fields in PadId if PeerIdValid is true.
529 PadId1
->PeerIdValid
&&
530 AsciiStriCmp ((CONST CHAR8
*) PadId1
->Id
.PeerId
, (CONST CHAR8
*) PadId2
->Id
.PeerId
) != 0
535 // Compare the IpAddress fields in PadId if PeerIdValid is false.
538 !PadId1
->PeerIdValid
&&
539 (PadId1
->Id
.IpAddress
.PrefixLength
!= PadId2
->Id
.IpAddress
.PrefixLength
||
540 CompareMem (&PadId1
->Id
.IpAddress
.Address
, &PadId2
->Id
.IpAddress
.Address
, sizeof (EFI_IP_ADDRESS
)) != 0)
549 Check if the SPD Selector is Zero by its LocalAddressCount and RemoteAddressCount
552 @param[in] Selector Pointer of the SPD Selector.
554 @retval TRUE If the SPD Selector is Zero.
555 @retval FALSE If the SPD Selector is not Zero.
560 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector
563 EFI_IPSEC_SPD_SELECTOR
*SpdSel
;
566 SpdSel
= &Selector
->SpdSelector
;
569 if (SpdSel
->LocalAddressCount
== 0 && SpdSel
->RemoteAddressCount
== 0) {
577 Check if the SA ID is Zero by its DestAddress.
579 @param[in] Selector Pointer of the SA ID.
581 @retval TRUE If the SA ID is Zero.
582 @retval FALSE If the SA ID is not Zero.
587 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector
591 EFI_IPSEC_CONFIG_SELECTOR ZeroSelector
;
595 ZeroMem (&ZeroSelector
, sizeof (EFI_IPSEC_CONFIG_SELECTOR
));
597 if (CompareMem (&ZeroSelector
, Selector
, sizeof (EFI_IPSEC_CONFIG_SELECTOR
)) == 0) {
605 Check if the PAD ID is Zero.
607 @param[in] Selector Pointer of the PAD ID.
609 @retval TRUE If the PAD ID is Zero.
610 @retval FALSE If the PAD ID is not Zero.
615 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector
618 EFI_IPSEC_PAD_ID
*PadId
;
619 EFI_IPSEC_PAD_ID ZeroId
;
622 PadId
= &Selector
->PadId
;
625 ZeroMem (&ZeroId
, sizeof (EFI_IPSEC_PAD_ID
));
627 if (CompareMem (PadId
, &ZeroId
, sizeof (EFI_IPSEC_PAD_ID
)) == 0) {
635 Copy Source SPD Selector to the Destination SPD Selector.
637 @param[in, out] DstSel Pointer of Destination SPD Selector.
638 @param[in] SrcSel Pointer of Source SPD Selector.
639 @param[in, out] Size The size of the Destination SPD Selector. If it
640 not NULL and its value less than the size of
641 Source SPD Selector, the value of Source SPD
642 Selector's size will be passed to caller by this
645 @retval EFI_INVALID_PARAMETER If the Destination or Source SPD Selector is NULL
646 @retval EFI_BUFFER_TOO_SMALL If the input Size is less than size of the Source SPD Selector.
647 @retval EFI_SUCCESS Copy Source SPD Selector to the Destination SPD
648 Selector successfully.
652 DuplicateSpdSelector (
653 IN OUT EFI_IPSEC_CONFIG_SELECTOR
*DstSel
,
654 IN EFI_IPSEC_CONFIG_SELECTOR
*SrcSel
,
658 EFI_IPSEC_SPD_SELECTOR
*Dst
;
659 EFI_IPSEC_SPD_SELECTOR
*Src
;
661 Dst
= &DstSel
->SpdSelector
;
662 Src
= &SrcSel
->SpdSelector
;
664 if (Dst
== NULL
|| Src
== NULL
) {
665 return EFI_INVALID_PARAMETER
;
668 if (Size
!= NULL
&& (*Size
) < SIZE_OF_SPD_SELECTOR (Src
)) {
669 *Size
= SIZE_OF_SPD_SELECTOR (Src
);
670 return EFI_BUFFER_TOO_SMALL
;
673 // Copy the base structure of SPD selector.
675 CopyMem (Dst
, Src
, sizeof (EFI_IPSEC_SPD_SELECTOR
));
678 // Copy the local address array of SPD selector.
680 Dst
->LocalAddress
= (EFI_IP_ADDRESS_INFO
*) (Dst
+ 1);
684 sizeof (EFI_IP_ADDRESS_INFO
) * Dst
->LocalAddressCount
688 // Copy the remote address array of SPD selector.
690 Dst
->RemoteAddress
= Dst
->LocalAddress
+ Dst
->LocalAddressCount
;
694 sizeof (EFI_IP_ADDRESS_INFO
) * Dst
->RemoteAddressCount
701 Copy Source SA ID to the Destination SA ID.
703 @param[in, out] DstSel Pointer of Destination SA ID.
704 @param[in] SrcSel Pointer of Source SA ID.
705 @param[in, out] Size The size of the Destination SA ID. If it
706 not NULL and its value less than the size of
707 Source SA ID, the value of Source SA ID's size
708 will be passed to caller by this parameter.
710 @retval EFI_INVALID_PARAMETER If the Destination or Source SA ID is NULL.
711 @retval EFI_BUFFER_TOO_SMALL If the input Size less than size of source SA ID.
712 @retval EFI_SUCCESS Copy Source SA ID to the Destination SA ID successfully.
717 IN OUT EFI_IPSEC_CONFIG_SELECTOR
*DstSel
,
718 IN EFI_IPSEC_CONFIG_SELECTOR
*SrcSel
,
722 EFI_IPSEC_SA_ID
*Dst
;
723 EFI_IPSEC_SA_ID
*Src
;
728 if (Dst
== NULL
|| Src
== NULL
) {
729 return EFI_INVALID_PARAMETER
;
732 if (Size
!= NULL
&& *Size
< sizeof (EFI_IPSEC_SA_ID
)) {
733 *Size
= sizeof (EFI_IPSEC_SA_ID
);
734 return EFI_BUFFER_TOO_SMALL
;
737 CopyMem (Dst
, Src
, sizeof (EFI_IPSEC_SA_ID
));
743 Copy Source PAD ID to the Destination PAD ID.
745 @param[in, out] DstSel Pointer of Destination PAD ID.
746 @param[in] SrcSel Pointer of Source PAD ID.
747 @param[in, out] Size The size of the Destination PAD ID. If it
748 not NULL and its value less than the size of
749 Source PAD ID, the value of Source PAD ID's size
750 will be passed to caller by this parameter.
752 @retval EFI_INVALID_PARAMETER If the Destination or Source PAD ID is NULL.
753 @retval EFI_BUFFER_TOO_SMALL If the input Size less than size of source PAD ID .
754 @retval EFI_SUCCESS Copy Source PAD ID to the Destination PAD ID successfully.
759 IN OUT EFI_IPSEC_CONFIG_SELECTOR
*DstSel
,
760 IN EFI_IPSEC_CONFIG_SELECTOR
*SrcSel
,
764 EFI_IPSEC_PAD_ID
*Dst
;
765 EFI_IPSEC_PAD_ID
*Src
;
767 Dst
= &DstSel
->PadId
;
768 Src
= &SrcSel
->PadId
;
770 if (Dst
== NULL
|| Src
== NULL
) {
771 return EFI_INVALID_PARAMETER
;
774 if (Size
!= NULL
&& *Size
< sizeof (EFI_IPSEC_PAD_ID
)) {
775 *Size
= sizeof (EFI_IPSEC_PAD_ID
);
776 return EFI_BUFFER_TOO_SMALL
;
779 CopyMem (Dst
, Src
, sizeof (EFI_IPSEC_PAD_ID
));
785 Fix the value of some members of SPD Selector.
787 This function is called by IpSecCopyPolicyEntry()which copy the Policy
788 Entry into the Variable. Since some members in SPD Selector are pointers,
789 a physical address to relative address convertion is required before copying
790 this SPD entry into the variable.
792 @param[in] Selector Pointer of SPD Selector.
793 @param[in, out] Data Pointer of SPD Data.
798 IN EFI_IPSEC_SPD_SELECTOR
*Selector
,
799 IN OUT EFI_IPSEC_SPD_DATA
*Data
803 // It assumes that all ref buffers in SPD selector and data are
804 // stored in the continous memory and close to the base structure.
806 FIX_REF_BUF_ADDR (Selector
->LocalAddress
, Selector
);
807 FIX_REF_BUF_ADDR (Selector
->RemoteAddress
, Selector
);
809 if (Data
->ProcessingPolicy
!= NULL
) {
810 if (Data
->ProcessingPolicy
->TunnelOption
!= NULL
) {
811 FIX_REF_BUF_ADDR (Data
->ProcessingPolicy
->TunnelOption
, Data
);
814 FIX_REF_BUF_ADDR (Data
->ProcessingPolicy
, Data
);
820 Fix the value of some members of SA ID.
822 This function is called by IpSecCopyPolicyEntry()which copy the Policy
823 Entry into the Variable. Since some members in SA ID are pointers,
824 a physical address to relative address conversion is required before copying
825 this SAD into the variable.
827 @param[in] SaId Pointer of SA ID
828 @param[in, out] Data Pointer of SA Data.
833 IN EFI_IPSEC_SA_ID
*SaId
,
834 IN OUT EFI_IPSEC_SA_DATA2
*Data
838 // It assumes that all ref buffers in SAD selector and data are
839 // stored in the continous memory and close to the base structure.
841 if (Data
->AlgoInfo
.EspAlgoInfo
.AuthKey
!= NULL
) {
842 FIX_REF_BUF_ADDR (Data
->AlgoInfo
.EspAlgoInfo
.AuthKey
, Data
);
845 if (SaId
->Proto
== EfiIPsecESP
&& Data
->AlgoInfo
.EspAlgoInfo
.EncKey
!= NULL
) {
846 FIX_REF_BUF_ADDR (Data
->AlgoInfo
.EspAlgoInfo
.EncKey
, Data
);
849 if (Data
->SpdSelector
!= NULL
) {
850 if (Data
->SpdSelector
->LocalAddress
!= NULL
) {
851 FIX_REF_BUF_ADDR (Data
->SpdSelector
->LocalAddress
, Data
);
854 FIX_REF_BUF_ADDR (Data
->SpdSelector
->RemoteAddress
, Data
);
855 FIX_REF_BUF_ADDR (Data
->SpdSelector
, Data
);
861 Fix the value of some members of PAD ID.
863 This function is called by IpSecCopyPolicyEntry()which copy the Policy
864 Entry into the Variable. Since some members in PAD ID are pointers,
865 a physical address to relative address conversion is required before copying
866 this PAD into the variable.
868 @param[in] PadId Pointer of PAD ID.
869 @param[in, out] Data Pointer of PAD Data.
874 IN EFI_IPSEC_PAD_ID
*PadId
,
875 IN OUT EFI_IPSEC_PAD_DATA
*Data
879 // It assumes that all ref buffers in pad selector and data are
880 // stored in the continous memory and close to the base structure.
882 if (Data
->AuthData
!= NULL
) {
883 FIX_REF_BUF_ADDR (Data
->AuthData
, Data
);
886 if (Data
->RevocationData
!= NULL
) {
887 FIX_REF_BUF_ADDR (Data
->RevocationData
, Data
);
893 Recover the value of some members of SPD Selector.
895 This function is corresponding to FixSpdEntry(). It recovers the value of members
896 of SPD Selector that are fixed by FixSpdEntry().
898 @param[in, out] Selector Pointer of SPD Selector.
899 @param[in, out] Data Pointer of SPD Data.
904 IN OUT EFI_IPSEC_SPD_SELECTOR
*Selector
,
905 IN OUT EFI_IPSEC_SPD_DATA
*Data
909 // It assumes that all ref buffers in SPD selector and data are
910 // stored in the continous memory and close to the base structure.
912 UNFIX_REF_BUF_ADDR (Selector
->LocalAddress
, Selector
);
913 UNFIX_REF_BUF_ADDR (Selector
->RemoteAddress
, Selector
);
915 if (Data
->ProcessingPolicy
!= NULL
) {
916 UNFIX_REF_BUF_ADDR (Data
->ProcessingPolicy
, Data
);
917 if (Data
->ProcessingPolicy
->TunnelOption
!= NULL
) {
918 UNFIX_REF_BUF_ADDR (Data
->ProcessingPolicy
->TunnelOption
, Data
);
925 Recover the value of some members of SA ID.
927 This function is corresponding to FixSadEntry(). It recovers the value of members
928 of SAD ID that are fixed by FixSadEntry().
930 @param[in, out] SaId Pointer of SAD ID.
931 @param[in, out] Data Pointer of SAD Data.
936 IN OUT EFI_IPSEC_SA_ID
*SaId
,
937 IN OUT EFI_IPSEC_SA_DATA2
*Data
941 // It assumes that all ref buffers in SAD selector and data are
942 // stored in the continous memory and close to the base structure.
944 if (Data
->AlgoInfo
.EspAlgoInfo
.AuthKey
!= NULL
) {
945 UNFIX_REF_BUF_ADDR (Data
->AlgoInfo
.EspAlgoInfo
.AuthKey
, Data
);
948 if (SaId
->Proto
== EfiIPsecESP
&& Data
->AlgoInfo
.EspAlgoInfo
.EncKey
!= NULL
) {
949 UNFIX_REF_BUF_ADDR (Data
->AlgoInfo
.EspAlgoInfo
.EncKey
, Data
);
952 if (Data
->SpdSelector
!= NULL
) {
953 UNFIX_REF_BUF_ADDR (Data
->SpdSelector
, Data
);
954 if (Data
->SpdSelector
->LocalAddress
!= NULL
) {
955 UNFIX_REF_BUF_ADDR (Data
->SpdSelector
->LocalAddress
, Data
);
958 UNFIX_REF_BUF_ADDR (Data
->SpdSelector
->RemoteAddress
, Data
);
964 Recover the value of some members of PAD ID.
966 This function is corresponding to FixPadEntry(). It recovers the value of members
967 of PAD ID that are fixed by FixPadEntry().
969 @param[in] PadId Pointer of PAD ID.
970 @param[in, out] Data Pointer of PAD Data.
975 IN EFI_IPSEC_PAD_ID
*PadId
,
976 IN OUT EFI_IPSEC_PAD_DATA
*Data
980 // It assumes that all ref buffers in pad selector and data are
981 // stored in the continous memory and close to the base structure.
983 if (Data
->AuthData
!= NULL
) {
984 UNFIX_REF_BUF_ADDR (Data
->AuthData
, Data
);
987 if (Data
->RevocationData
!= NULL
) {
988 UNFIX_REF_BUF_ADDR (Data
->RevocationData
, Data
);
994 Set the security policy information for the EFI IPsec driver.
996 The IPsec configuration data has a unique selector/identifier separately to
997 identify a data entry.
999 @param[in] Selector Pointer to an entry selector on operated
1000 configuration data specified by DataType.
1001 A NULL Selector causes the entire specified-type
1002 configuration information to be flushed.
1003 @param[in] Data The data buffer to be set. The structure
1004 of the data buffer should be EFI_IPSEC_SPD_DATA.
1005 @param[in] Context Pointer to one entry selector that describes
1006 the expected position the new data entry will
1007 be added. If Context is NULL, the new entry will
1008 be appended the end of database.
1010 @retval EFI_INVALID_PARAMETER One or more of the following are TRUE:
1011 - Selector is not NULL and its LocalAddress
1012 is NULL or its RemoteAddress is NULL.
1013 - Data is not NULL and its Action is Protected
1014 and its plolicy is NULL.
1015 - Data is not NULL, its Action is not protected,
1016 and its policy is not NULL.
1017 - The Action of Data is Protected, its policy
1018 mode is Tunnel, and its tunnel option is NULL.
1019 - The Action of Data is protected and its policy
1020 mode is not Tunnel and it tunnel option is not NULL.
1021 @retval EFI_OUT_OF_RESOURCED The required system resource could not be allocated.
1022 @retval EFI_SUCCESS The specified configuration data was obtained successfully.
1027 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector
,
1029 IN VOID
*Context OPTIONAL
1032 EFI_IPSEC_SPD_SELECTOR
*SpdSel
;
1033 EFI_IPSEC_SPD_DATA
*SpdData
;
1034 EFI_IPSEC_SPD_SELECTOR
*InsertBefore
;
1035 LIST_ENTRY
*SpdList
;
1036 LIST_ENTRY
*SadList
;
1038 LIST_ENTRY
*EntryInsertBefore
;
1041 LIST_ENTRY
*NextEntry
;
1042 IPSEC_SPD_ENTRY
*SpdEntry
;
1043 IPSEC_SAD_ENTRY
*SadEntry
;
1047 SpdSel
= (Selector
== NULL
) ? NULL
: &Selector
->SpdSelector
;
1048 SpdData
= (Data
== NULL
) ? NULL
: (EFI_IPSEC_SPD_DATA
*) Data
;
1049 InsertBefore
= (Context
== NULL
) ? NULL
: &((EFI_IPSEC_CONFIG_SELECTOR
*) Context
)->SpdSelector
;
1050 SpdList
= &mConfigData
[IPsecConfigDataTypeSpd
];
1052 if (SpdSel
!= NULL
) {
1053 if (SpdSel
->LocalAddress
== NULL
|| SpdSel
->RemoteAddress
== NULL
) {
1054 return EFI_INVALID_PARAMETER
;
1058 if (SpdData
!= NULL
) {
1059 if ((SpdData
->Action
== EfiIPsecActionProtect
&& SpdData
->ProcessingPolicy
== NULL
) ||
1060 (SpdData
->Action
!= EfiIPsecActionProtect
&& SpdData
->ProcessingPolicy
!= NULL
)
1062 return EFI_INVALID_PARAMETER
;
1065 if (SpdData
->Action
== EfiIPsecActionProtect
) {
1066 if ((SpdData
->ProcessingPolicy
->Mode
== EfiIPsecTunnel
&& SpdData
->ProcessingPolicy
->TunnelOption
== NULL
) ||
1067 (SpdData
->ProcessingPolicy
->Mode
!= EfiIPsecTunnel
&& SpdData
->ProcessingPolicy
->TunnelOption
!= NULL
)
1069 return EFI_INVALID_PARAMETER
;
1074 // The default behavior is to insert the node ahead of the header.
1076 EntryInsertBefore
= SpdList
;
1079 // Remove the existed SPD entry.
1081 NET_LIST_FOR_EACH_SAFE (Entry
, NextEntry
, SpdList
) {
1083 SpdEntry
= IPSEC_SPD_ENTRY_FROM_LIST (Entry
);
1085 if (SpdSel
== NULL
||
1086 CompareSpdSelector ((EFI_IPSEC_CONFIG_SELECTOR
*) SpdEntry
->Selector
, (EFI_IPSEC_CONFIG_SELECTOR
*) SpdSel
)
1089 // Record the existed entry position to keep the original order.
1091 EntryInsertBefore
= SpdEntry
->List
.ForwardLink
;
1092 RemoveEntryList (&SpdEntry
->List
);
1095 // Update the reverse ref of SAD entry in the SPD.sas list.
1097 SpdSas
= &SpdEntry
->Data
->Sas
;
1100 // TODO: Deleted the related SAs.
1102 NET_LIST_FOR_EACH (Entry2
, SpdSas
) {
1103 SadEntry
= IPSEC_SAD_ENTRY_FROM_SPD (Entry2
);
1104 SadEntry
->Data
->SpdEntry
= NULL
;
1108 // Free the existed SPD entry
1110 FreePool (SpdEntry
);
1114 // Return success here if only want to remove the SPD entry.
1116 if (SpdData
== NULL
|| SpdSel
== NULL
) {
1120 // Search the appointed entry position if InsertBefore is not NULL.
1122 if (InsertBefore
!= NULL
) {
1124 NET_LIST_FOR_EACH (Entry
, SpdList
) {
1125 SpdEntry
= IPSEC_SPD_ENTRY_FROM_LIST (Entry
);
1127 if (CompareSpdSelector (
1128 (EFI_IPSEC_CONFIG_SELECTOR
*) SpdEntry
->Selector
,
1129 (EFI_IPSEC_CONFIG_SELECTOR
*) InsertBefore
1131 EntryInsertBefore
= Entry
;
1138 // Do Padding for the different Arch.
1140 SpdEntrySize
= ALIGN_VARIABLE (sizeof (IPSEC_SPD_ENTRY
));
1141 SpdEntrySize
= ALIGN_VARIABLE (SpdEntrySize
+ (UINTN
)SIZE_OF_SPD_SELECTOR (SpdSel
));
1142 SpdEntrySize
+= IpSecGetSizeOfEfiSpdData (SpdData
);
1144 SpdEntry
= AllocateZeroPool (SpdEntrySize
);
1146 if (SpdEntry
== NULL
) {
1147 return EFI_OUT_OF_RESOURCES
;
1150 // Fix the address of Selector and Data buffer and copy them, which is
1151 // continous memory and close to the base structure of SPD entry.
1153 SpdEntry
->Selector
= (EFI_IPSEC_SPD_SELECTOR
*) ALIGN_POINTER ((SpdEntry
+ 1), sizeof (UINTN
));
1154 SpdEntry
->Data
= (IPSEC_SPD_DATA
*) ALIGN_POINTER (
1155 ((UINT8
*) SpdEntry
->Selector
+ SIZE_OF_SPD_SELECTOR (SpdSel
)),
1159 DuplicateSpdSelector (
1160 (EFI_IPSEC_CONFIG_SELECTOR
*) SpdEntry
->Selector
,
1161 (EFI_IPSEC_CONFIG_SELECTOR
*) SpdSel
,
1166 SpdEntry
->Data
->Name
,
1168 sizeof (SpdData
->Name
)
1170 SpdEntry
->Data
->PackageFlag
= SpdData
->PackageFlag
;
1171 SpdEntry
->Data
->TrafficDirection
= SpdData
->TrafficDirection
;
1172 SpdEntry
->Data
->Action
= SpdData
->Action
;
1175 // Fix the address of ProcessingPolicy and copy it if need, which is continous
1176 // memory and close to the base structure of SAD data.
1178 if (SpdData
->Action
!= EfiIPsecActionProtect
) {
1179 SpdEntry
->Data
->ProcessingPolicy
= NULL
;
1181 SpdEntry
->Data
->ProcessingPolicy
= (EFI_IPSEC_PROCESS_POLICY
*) ALIGN_POINTER (
1185 IpSecDuplicateProcessPolicy (SpdEntry
->Data
->ProcessingPolicy
, SpdData
->ProcessingPolicy
);
1188 // Update the sas list of the new SPD entry.
1190 InitializeListHead (&SpdEntry
->Data
->Sas
);
1192 SadList
= &mConfigData
[IPsecConfigDataTypeSad
];
1194 NET_LIST_FOR_EACH (Entry
, SadList
) {
1195 SadEntry
= IPSEC_SAD_ENTRY_FROM_LIST (Entry
);
1197 for (Index
= 0; Index
< SpdData
->SaIdCount
; Index
++) {
1200 (EFI_IPSEC_CONFIG_SELECTOR
*) &SpdData
->SaId
[Index
],
1201 (EFI_IPSEC_CONFIG_SELECTOR
*) SadEntry
->Id
1203 if (SadEntry
->Data
->SpdEntry
!= NULL
) {
1204 RemoveEntryList (&SadEntry
->BySpd
);
1206 InsertTailList (&SpdEntry
->Data
->Sas
, &SadEntry
->BySpd
);
1207 SadEntry
->Data
->SpdEntry
= SpdEntry
;
1208 DuplicateSpdSelector (
1209 (EFI_IPSEC_CONFIG_SELECTOR
*)SadEntry
->Data
->SpdSelector
,
1210 (EFI_IPSEC_CONFIG_SELECTOR
*)SpdEntry
->Selector
,
1217 // Insert the new SPD entry.
1219 InsertTailList (EntryInsertBefore
, &SpdEntry
->List
);
1225 Set the security association information for the EFI IPsec driver.
1227 The IPsec configuration data has a unique selector/identifier separately to
1228 identify a data entry.
1230 @param[in] Selector Pointer to an entry selector on operated
1231 configuration data specified by DataType.
1232 A NULL Selector causes the entire specified-type
1233 configuration information to be flushed.
1234 @param[in] Data The data buffer to be set. The structure
1235 of the data buffer should be EFI_IPSEC_SA_DATA.
1236 @param[in] Context Pointer to one entry selector which describes
1237 the expected position the new data entry will
1238 be added. If Context is NULL,the new entry will
1239 be appended the end of database.
1241 @retval EFI_OUT_OF_RESOURCED The required system resource could not be allocated.
1242 @retval EFI_SUCCESS The specified configuration data was obtained successfully.
1247 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector
,
1249 IN VOID
*Context OPTIONAL
1252 IPSEC_SAD_ENTRY
*SadEntry
;
1253 IPSEC_SPD_ENTRY
*SpdEntry
;
1255 LIST_ENTRY
*NextEntry
;
1256 LIST_ENTRY
*SadList
;
1257 LIST_ENTRY
*SpdList
;
1258 EFI_IPSEC_SA_ID
*SaId
;
1259 EFI_IPSEC_SA_DATA2
*SaData
;
1260 EFI_IPSEC_SA_ID
*InsertBefore
;
1261 LIST_ENTRY
*EntryInsertBefore
;
1264 SaId
= (Selector
== NULL
) ? NULL
: &Selector
->SaId
;
1265 SaData
= (Data
== NULL
) ? NULL
: (EFI_IPSEC_SA_DATA2
*) Data
;
1266 InsertBefore
= (Context
== NULL
) ? NULL
: &((EFI_IPSEC_CONFIG_SELECTOR
*) Context
)->SaId
;
1267 SadList
= &mConfigData
[IPsecConfigDataTypeSad
];
1270 // The default behavior is to insert the node ahead of the header.
1272 EntryInsertBefore
= SadList
;
1275 // Remove the existed SAD entry.
1277 NET_LIST_FOR_EACH_SAFE (Entry
, NextEntry
, SadList
) {
1279 SadEntry
= IPSEC_SAD_ENTRY_FROM_LIST (Entry
);
1283 (EFI_IPSEC_CONFIG_SELECTOR
*) SadEntry
->Id
,
1284 (EFI_IPSEC_CONFIG_SELECTOR
*) SaId
1287 // Record the existed entry position to keep the original order.
1289 EntryInsertBefore
= SadEntry
->List
.ForwardLink
;
1292 // Update the related SAD.byspd field.
1294 if (SadEntry
->Data
->SpdEntry
!= NULL
) {
1295 RemoveEntryList (&SadEntry
->BySpd
);
1298 RemoveEntryList (&SadEntry
->List
);
1299 FreePool (SadEntry
);
1303 // Return success here if only want to remove the SAD entry
1305 if (SaData
== NULL
|| SaId
== NULL
) {
1309 // Search the appointed entry position if InsertBefore is not NULL.
1311 if (InsertBefore
!= NULL
) {
1313 NET_LIST_FOR_EACH (Entry
, SadList
) {
1314 SadEntry
= IPSEC_SAD_ENTRY_FROM_LIST (Entry
);
1317 (EFI_IPSEC_CONFIG_SELECTOR
*) SadEntry
->Id
,
1318 (EFI_IPSEC_CONFIG_SELECTOR
*) InsertBefore
1320 EntryInsertBefore
= Entry
;
1327 // Do Padding for different Arch.
1329 SadEntrySize
= ALIGN_VARIABLE (sizeof (IPSEC_SAD_ENTRY
));
1330 SadEntrySize
= ALIGN_VARIABLE (SadEntrySize
+ sizeof (EFI_IPSEC_SA_ID
));
1331 SadEntrySize
= ALIGN_VARIABLE (SadEntrySize
+ sizeof (IPSEC_SAD_DATA
));
1333 if (SaId
->Proto
== EfiIPsecAH
) {
1334 SadEntrySize
+= SaData
->AlgoInfo
.AhAlgoInfo
.AuthKeyLength
;
1336 SadEntrySize
= ALIGN_VARIABLE (SadEntrySize
+ SaData
->AlgoInfo
.EspAlgoInfo
.AuthKeyLength
);
1337 SadEntrySize
+= ALIGN_VARIABLE (SaData
->AlgoInfo
.EspAlgoInfo
.EncKeyLength
);
1340 if (SaData
->SpdSelector
!= NULL
) {
1341 SadEntrySize
+= SadEntrySize
+ (UINTN
)SIZE_OF_SPD_SELECTOR (SaData
->SpdSelector
);
1343 SadEntry
= AllocateZeroPool (SadEntrySize
);
1345 if (SadEntry
== NULL
) {
1346 return EFI_OUT_OF_RESOURCES
;
1349 // Fix the address of Id and Data buffer and copy them, which is
1350 // continous memory and close to the base structure of SAD entry.
1352 SadEntry
->Id
= (EFI_IPSEC_SA_ID
*) ALIGN_POINTER ((SadEntry
+ 1), sizeof (UINTN
));
1353 SadEntry
->Data
= (IPSEC_SAD_DATA
*) ALIGN_POINTER ((SadEntry
->Id
+ 1), sizeof (UINTN
));
1355 CopyMem (SadEntry
->Id
, SaId
, sizeof (EFI_IPSEC_SA_ID
));
1357 SadEntry
->Data
->Mode
= SaData
->Mode
;
1358 SadEntry
->Data
->SequenceNumber
= SaData
->SNCount
;
1359 SadEntry
->Data
->AntiReplayWindowSize
= SaData
->AntiReplayWindows
;
1362 &SadEntry
->Data
->AntiReplayBitmap
,
1363 sizeof (SadEntry
->Data
->AntiReplayBitmap
)
1367 &SadEntry
->Data
->AlgoInfo
,
1368 sizeof (EFI_IPSEC_ALGO_INFO
)
1371 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthAlgoId
= SaData
->AlgoInfo
.EspAlgoInfo
.AuthAlgoId
;
1372 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthKeyLength
= SaData
->AlgoInfo
.EspAlgoInfo
.AuthKeyLength
;
1374 if (SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthKeyLength
!= 0) {
1375 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthKey
= (VOID
*) ALIGN_POINTER ((SadEntry
->Data
+ 1), sizeof (UINTN
));
1377 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthKey
,
1378 SaData
->AlgoInfo
.EspAlgoInfo
.AuthKey
,
1379 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthKeyLength
1383 if (SaId
->Proto
== EfiIPsecESP
) {
1384 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncAlgoId
= SaData
->AlgoInfo
.EspAlgoInfo
.EncAlgoId
;
1385 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncKeyLength
= SaData
->AlgoInfo
.EspAlgoInfo
.EncKeyLength
;
1387 if (SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncKeyLength
!= 0) {
1388 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncKey
= (VOID
*) ALIGN_POINTER (
1389 ((UINT8
*) (SadEntry
->Data
+ 1) +
1390 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthKeyLength
),
1394 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncKey
,
1395 SaData
->AlgoInfo
.EspAlgoInfo
.EncKey
,
1396 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncKeyLength
1402 &SadEntry
->Data
->SaLifetime
,
1403 &SaData
->SaLifetime
,
1404 sizeof (EFI_IPSEC_SA_LIFETIME
)
1407 SadEntry
->Data
->PathMTU
= SaData
->PathMTU
;
1408 SadEntry
->Data
->SpdSelector
= NULL
;
1409 SadEntry
->Data
->ESNEnabled
= FALSE
;
1410 SadEntry
->Data
->ManualSet
= SaData
->ManualSet
;
1413 // Copy Tunnel Source/Destination Address
1415 if (SaData
->Mode
== EfiIPsecTunnel
) {
1417 &SadEntry
->Data
->TunnelDestAddress
,
1418 &SaData
->TunnelDestinationAddress
,
1419 sizeof (EFI_IP_ADDRESS
)
1422 &SadEntry
->Data
->TunnelSourceAddress
,
1423 &SaData
->TunnelSourceAddress
,
1424 sizeof (EFI_IP_ADDRESS
)
1428 // Update the spd.sas list of the spd entry specified by SAD selector
1430 SpdList
= &mConfigData
[IPsecConfigDataTypeSpd
];
1432 for (Entry
= SpdList
->ForwardLink
; Entry
!= SpdList
&& SaData
->SpdSelector
!= NULL
; Entry
= Entry
->ForwardLink
) {
1434 SpdEntry
= IPSEC_SPD_ENTRY_FROM_LIST (Entry
);
1435 if (IsSubSpdSelector (
1436 (EFI_IPSEC_CONFIG_SELECTOR
*) SaData
->SpdSelector
,
1437 (EFI_IPSEC_CONFIG_SELECTOR
*) SpdEntry
->Selector
1438 ) && SpdEntry
->Data
->Action
== EfiIPsecActionProtect
) {
1439 SadEntry
->Data
->SpdEntry
= SpdEntry
;
1440 SadEntry
->Data
->SpdSelector
= (EFI_IPSEC_SPD_SELECTOR
*)((UINT8
*)SadEntry
+
1442 (UINTN
)SIZE_OF_SPD_SELECTOR (SaData
->SpdSelector
)
1444 DuplicateSpdSelector (
1445 (EFI_IPSEC_CONFIG_SELECTOR
*) SadEntry
->Data
->SpdSelector
,
1446 (EFI_IPSEC_CONFIG_SELECTOR
*) SaData
->SpdSelector
,
1449 InsertTailList (&SpdEntry
->Data
->Sas
, &SadEntry
->BySpd
);
1453 // Insert the new SAD entry.
1455 InsertTailList (EntryInsertBefore
, &SadEntry
->List
);
1461 Set the peer authorization configuration information for the EFI IPsec driver.
1463 The IPsec configuration data has a unique selector/identifier separately to
1464 identify a data entry.
1466 @param[in] Selector Pointer to an entry selector on operated
1467 configuration data specified by DataType.
1468 A NULL Selector causes the entire specified-type
1469 configuration information to be flushed.
1470 @param[in] Data The data buffer to be set. The structure
1471 of the data buffer should be EFI_IPSEC_PAD_DATA.
1472 @param[in] Context Pointer to one entry selector that describes
1473 the expected position the new data entry will
1474 be added. If Context is NULL, the new entry will
1475 be appended the end of database.
1477 @retval EFI_OUT_OF_RESOURCES The required system resources could not be allocated.
1478 @retval EFI_SUCCESS The specified configuration data was obtained successfully.
1483 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector
,
1485 IN VOID
*Context OPTIONAL
1488 IPSEC_PAD_ENTRY
*PadEntry
;
1489 EFI_IPSEC_PAD_ID
*PadId
;
1490 EFI_IPSEC_PAD_DATA
*PadData
;
1491 LIST_ENTRY
*PadList
;
1493 LIST_ENTRY
*NextEntry
;
1494 EFI_IPSEC_PAD_ID
*InsertBefore
;
1495 LIST_ENTRY
*EntryInsertBefore
;
1498 PadId
= (Selector
== NULL
) ? NULL
: &Selector
->PadId
;
1499 PadData
= (Data
== NULL
) ? NULL
: (EFI_IPSEC_PAD_DATA
*) Data
;
1500 InsertBefore
= (Context
== NULL
) ? NULL
: &((EFI_IPSEC_CONFIG_SELECTOR
*) Context
)->PadId
;
1501 PadList
= &mConfigData
[IPsecConfigDataTypePad
];
1504 // The default behavior is to insert the node ahead of the header.
1506 EntryInsertBefore
= PadList
;
1509 // Remove the existed pad entry.
1511 NET_LIST_FOR_EACH_SAFE (Entry
, NextEntry
, PadList
) {
1513 PadEntry
= IPSEC_PAD_ENTRY_FROM_LIST (Entry
);
1515 if (PadId
== NULL
||
1516 ComparePadId ((EFI_IPSEC_CONFIG_SELECTOR
*) PadEntry
->Id
, (EFI_IPSEC_CONFIG_SELECTOR
*) PadId
)
1519 // Record the existed entry position to keep the original order.
1521 EntryInsertBefore
= PadEntry
->List
.ForwardLink
;
1522 RemoveEntryList (&PadEntry
->List
);
1524 FreePool (PadEntry
);
1528 // Return success here if only want to remove the pad entry
1530 if (PadData
== NULL
|| PadId
== NULL
) {
1534 // Search the appointed entry position if InsertBefore is not NULL.
1536 if (InsertBefore
!= NULL
) {
1538 NET_LIST_FOR_EACH (Entry
, PadList
) {
1539 PadEntry
= IPSEC_PAD_ENTRY_FROM_LIST (Entry
);
1542 (EFI_IPSEC_CONFIG_SELECTOR
*) PadEntry
->Id
,
1543 (EFI_IPSEC_CONFIG_SELECTOR
*) InsertBefore
1545 EntryInsertBefore
= Entry
;
1552 // Do PADDING for different arch.
1554 PadEntrySize
= ALIGN_VARIABLE (sizeof (IPSEC_PAD_ENTRY
));
1555 PadEntrySize
= ALIGN_VARIABLE (PadEntrySize
+ sizeof (EFI_IPSEC_PAD_ID
));
1556 PadEntrySize
= ALIGN_VARIABLE (PadEntrySize
+ sizeof (EFI_IPSEC_PAD_DATA
));
1557 PadEntrySize
= ALIGN_VARIABLE (PadEntrySize
+ (PadData
->AuthData
!= NULL
? PadData
->AuthDataSize
: 0));
1558 PadEntrySize
+= PadData
->RevocationData
!= NULL
? PadData
->RevocationDataSize
: 0;
1560 PadEntry
= AllocateZeroPool (PadEntrySize
);
1562 if (PadEntry
== NULL
) {
1563 return EFI_OUT_OF_RESOURCES
;
1566 // Fix the address of Id and Data buffer and copy them, which is
1567 // continous memory and close to the base structure of pad entry.
1569 PadEntry
->Id
= (EFI_IPSEC_PAD_ID
*) ALIGN_POINTER ((PadEntry
+ 1), sizeof (UINTN
));
1570 PadEntry
->Data
= (EFI_IPSEC_PAD_DATA
*) ALIGN_POINTER ((PadEntry
->Id
+ 1), sizeof (UINTN
));
1572 CopyMem (PadEntry
->Id
, PadId
, sizeof (EFI_IPSEC_PAD_ID
));
1574 PadEntry
->Data
->AuthProtocol
= PadData
->AuthProtocol
;
1575 PadEntry
->Data
->AuthMethod
= PadData
->AuthMethod
;
1576 PadEntry
->Data
->IkeIdFlag
= PadData
->IkeIdFlag
;
1578 if (PadData
->AuthData
!= NULL
) {
1579 PadEntry
->Data
->AuthDataSize
= PadData
->AuthDataSize
;
1580 PadEntry
->Data
->AuthData
= (VOID
*) ALIGN_POINTER (PadEntry
->Data
+ 1, sizeof (UINTN
));
1582 PadEntry
->Data
->AuthData
,
1584 PadData
->AuthDataSize
1587 PadEntry
->Data
->AuthDataSize
= 0;
1588 PadEntry
->Data
->AuthData
= NULL
;
1591 if (PadData
->RevocationData
!= NULL
) {
1592 PadEntry
->Data
->RevocationDataSize
= PadData
->RevocationDataSize
;
1593 PadEntry
->Data
->RevocationData
= (VOID
*) ALIGN_POINTER (
1594 ((UINT8
*) (PadEntry
->Data
+ 1) + PadData
->AuthDataSize
),
1598 PadEntry
->Data
->RevocationData
,
1599 PadData
->RevocationData
,
1600 PadData
->RevocationDataSize
1603 PadEntry
->Data
->RevocationDataSize
= 0;
1604 PadEntry
->Data
->RevocationData
= NULL
;
1607 // Insert the new pad entry.
1609 InsertTailList (EntryInsertBefore
, &PadEntry
->List
);
1615 This function lookup the data entry from IPsec SPD. Return the configuration
1616 value of the specified SPD Entry.
1618 @param[in] Selector Pointer to an entry selector which is an identifier
1620 @param[in, out] DataSize On output the size of data returned in Data.
1621 @param[out] Data The buffer to return the contents of the IPsec
1622 configuration data. The type of the data buffer
1623 is associated with the DataType.
1625 @retval EFI_SUCCESS The specified configuration data was obtained successfully.
1626 @retval EFI_INVALID_PARAMETER Data is NULL and *DataSize is not zero.
1627 @retval EFI_NOT_FOUND The configuration data specified by Selector is not found.
1628 @retval EFI_BUFFER_TOO_SMALL The DataSize is too small for the result. DataSize has been
1629 updated with the size needed to complete the request.
1634 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector
,
1635 IN OUT UINTN
*DataSize
,
1639 IPSEC_SPD_ENTRY
*SpdEntry
;
1640 IPSEC_SAD_ENTRY
*SadEntry
;
1641 EFI_IPSEC_SPD_SELECTOR
*SpdSel
;
1642 EFI_IPSEC_SPD_DATA
*SpdData
;
1643 LIST_ENTRY
*SpdList
;
1648 SpdSel
= &Selector
->SpdSelector
;
1649 SpdData
= (EFI_IPSEC_SPD_DATA
*) Data
;
1650 SpdList
= &mConfigData
[IPsecConfigDataTypeSpd
];
1652 NET_LIST_FOR_EACH (Entry
, SpdList
) {
1653 SpdEntry
= IPSEC_SPD_ENTRY_FROM_LIST (Entry
);
1656 // Find the required SPD entry
1658 if (CompareSpdSelector (
1659 (EFI_IPSEC_CONFIG_SELECTOR
*) SpdSel
,
1660 (EFI_IPSEC_CONFIG_SELECTOR
*) SpdEntry
->Selector
1663 RequiredSize
= IpSecGetSizeOfSpdData (SpdEntry
->Data
);
1664 if (*DataSize
< RequiredSize
) {
1665 *DataSize
= RequiredSize
;
1666 return EFI_BUFFER_TOO_SMALL
;
1669 if (SpdData
== NULL
) {
1670 return EFI_INVALID_PARAMETER
;
1673 *DataSize
= RequiredSize
;
1676 // Extract and fill all SaId array from the SPD.sas list
1678 SpdSas
= &SpdEntry
->Data
->Sas
;
1679 SpdData
->SaIdCount
= 0;
1681 NET_LIST_FOR_EACH (Entry
, SpdSas
) {
1682 SadEntry
= IPSEC_SAD_ENTRY_FROM_SPD (Entry
);
1684 &SpdData
->SaId
[SpdData
->SaIdCount
++],
1686 sizeof (EFI_IPSEC_SA_ID
)
1690 // Fill the other fields in SPD data.
1692 CopyMem (SpdData
->Name
, SpdEntry
->Data
->Name
, sizeof (SpdData
->Name
));
1694 SpdData
->PackageFlag
= SpdEntry
->Data
->PackageFlag
;
1695 SpdData
->TrafficDirection
= SpdEntry
->Data
->TrafficDirection
;
1696 SpdData
->Action
= SpdEntry
->Data
->Action
;
1698 if (SpdData
->Action
!= EfiIPsecActionProtect
) {
1699 SpdData
->ProcessingPolicy
= NULL
;
1701 SpdData
->ProcessingPolicy
= (EFI_IPSEC_PROCESS_POLICY
*) ((UINT8
*) SpdData
+ sizeof (EFI_IPSEC_SPD_DATA
) + (SpdData
->SaIdCount
- 1) * sizeof (EFI_IPSEC_SA_ID
));
1703 IpSecDuplicateProcessPolicy (
1704 SpdData
->ProcessingPolicy
,
1705 SpdEntry
->Data
->ProcessingPolicy
1713 return EFI_NOT_FOUND
;
1717 This function lookup the data entry from IPsec SAD. Return the configuration
1718 value of the specified SAD Entry.
1720 @param[in] Selector Pointer to an entry selector which is an identifier
1722 @param[in, out] DataSize On output, the size of data returned in Data.
1723 @param[out] Data The buffer to return the contents of the IPsec
1724 configuration data. The type of the data buffer
1725 is associated with the DataType.
1727 @retval EFI_SUCCESS The specified configuration data was obtained successfully.
1728 @retval EFI_NOT_FOUND The configuration data specified by Selector is not found.
1729 @retval EFI_BUFFER_TOO_SMALL The DataSize is too small for the result. DataSize has been
1730 updated with the size needed to complete the request.
1735 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector
,
1736 IN OUT UINTN
*DataSize
,
1740 IPSEC_SAD_ENTRY
*SadEntry
;
1742 LIST_ENTRY
*SadList
;
1743 EFI_IPSEC_SA_ID
*SaId
;
1744 EFI_IPSEC_SA_DATA2
*SaData
;
1747 SaId
= &Selector
->SaId
;
1748 SaData
= (EFI_IPSEC_SA_DATA2
*) Data
;
1749 SadList
= &mConfigData
[IPsecConfigDataTypeSad
];
1751 NET_LIST_FOR_EACH (Entry
, SadList
) {
1752 SadEntry
= IPSEC_SAD_ENTRY_FROM_LIST (Entry
);
1755 // Find the required SAD entry.
1758 (EFI_IPSEC_CONFIG_SELECTOR
*) SaId
,
1759 (EFI_IPSEC_CONFIG_SELECTOR
*) SadEntry
->Id
1762 // Calculate the required size of the SAD entry.
1763 // Data Layout is follows:
1764 // |EFI_IPSEC_SA_DATA
1766 // |EncryptKey (Optional)
1767 // |SpdSelector (Optional)
1769 RequiredSize
= ALIGN_VARIABLE (sizeof (EFI_IPSEC_SA_DATA2
));
1771 if (SaId
->Proto
== EfiIPsecAH
) {
1772 RequiredSize
= ALIGN_VARIABLE (RequiredSize
+ SadEntry
->Data
->AlgoInfo
.AhAlgoInfo
.AuthKeyLength
);
1774 RequiredSize
= ALIGN_VARIABLE (RequiredSize
+ SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthKeyLength
);
1775 RequiredSize
= ALIGN_VARIABLE (RequiredSize
+ SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncKeyLength
);
1778 if (SadEntry
->Data
->SpdSelector
!= NULL
) {
1779 RequiredSize
+= SIZE_OF_SPD_SELECTOR (SadEntry
->Data
->SpdSelector
);
1782 if (*DataSize
< RequiredSize
) {
1783 *DataSize
= RequiredSize
;
1784 return EFI_BUFFER_TOO_SMALL
;
1788 // Fill the data fields of SAD entry.
1790 *DataSize
= RequiredSize
;
1791 SaData
->Mode
= SadEntry
->Data
->Mode
;
1792 SaData
->SNCount
= SadEntry
->Data
->SequenceNumber
;
1793 SaData
->AntiReplayWindows
= SadEntry
->Data
->AntiReplayWindowSize
;
1796 &SaData
->SaLifetime
,
1797 &SadEntry
->Data
->SaLifetime
,
1798 sizeof (EFI_IPSEC_SA_LIFETIME
)
1803 sizeof (EFI_IPSEC_ALGO_INFO
)
1806 if (SaId
->Proto
== EfiIPsecAH
) {
1808 // Copy AH alogrithm INFO to SaData
1810 SaData
->AlgoInfo
.AhAlgoInfo
.AuthAlgoId
= SadEntry
->Data
->AlgoInfo
.AhAlgoInfo
.AuthAlgoId
;
1811 SaData
->AlgoInfo
.AhAlgoInfo
.AuthKeyLength
= SadEntry
->Data
->AlgoInfo
.AhAlgoInfo
.AuthKeyLength
;
1812 if (SaData
->AlgoInfo
.AhAlgoInfo
.AuthKeyLength
!= 0) {
1813 SaData
->AlgoInfo
.AhAlgoInfo
.AuthKey
= (VOID
*) ALIGN_POINTER ((SaData
+ 1), sizeof (UINTN
));
1815 SaData
->AlgoInfo
.AhAlgoInfo
.AuthKey
,
1816 SadEntry
->Data
->AlgoInfo
.AhAlgoInfo
.AuthKey
,
1817 SaData
->AlgoInfo
.AhAlgoInfo
.AuthKeyLength
1820 } else if (SaId
->Proto
== EfiIPsecESP
) {
1822 // Copy ESP alogrithem INFO to SaData
1824 SaData
->AlgoInfo
.EspAlgoInfo
.AuthAlgoId
= SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthAlgoId
;
1825 SaData
->AlgoInfo
.EspAlgoInfo
.AuthKeyLength
= SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthKeyLength
;
1826 if (SaData
->AlgoInfo
.EspAlgoInfo
.AuthKeyLength
!= 0) {
1827 SaData
->AlgoInfo
.EspAlgoInfo
.AuthKey
= (VOID
*) ALIGN_POINTER ((SaData
+ 1), sizeof (UINTN
));
1829 SaData
->AlgoInfo
.EspAlgoInfo
.AuthKey
,
1830 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthKey
,
1831 SaData
->AlgoInfo
.EspAlgoInfo
.AuthKeyLength
1835 SaData
->AlgoInfo
.EspAlgoInfo
.EncAlgoId
= SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncAlgoId
;
1836 SaData
->AlgoInfo
.EspAlgoInfo
.EncKeyLength
= SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncKeyLength
;
1838 if (SaData
->AlgoInfo
.EspAlgoInfo
.EncKeyLength
!= 0) {
1839 SaData
->AlgoInfo
.EspAlgoInfo
.EncKey
= (VOID
*) ALIGN_POINTER (
1840 ((UINT8
*) (SaData
+ 1) +
1841 SaData
->AlgoInfo
.EspAlgoInfo
.AuthKeyLength
),
1845 SaData
->AlgoInfo
.EspAlgoInfo
.EncKey
,
1846 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncKey
,
1847 SaData
->AlgoInfo
.EspAlgoInfo
.EncKeyLength
1852 SaData
->PathMTU
= SadEntry
->Data
->PathMTU
;
1855 // Fill Tunnel Address if it is Tunnel Mode
1857 if (SadEntry
->Data
->Mode
== EfiIPsecTunnel
) {
1859 &SaData
->TunnelDestinationAddress
,
1860 &SadEntry
->Data
->TunnelDestAddress
,
1861 sizeof (EFI_IP_ADDRESS
)
1864 &SaData
->TunnelSourceAddress
,
1865 &SadEntry
->Data
->TunnelSourceAddress
,
1866 sizeof (EFI_IP_ADDRESS
)
1870 // Fill the spd selector field of SAD data
1872 if (SadEntry
->Data
->SpdSelector
!= NULL
) {
1874 SaData
->SpdSelector
= (EFI_IPSEC_SPD_SELECTOR
*) (
1877 SIZE_OF_SPD_SELECTOR (SadEntry
->Data
->SpdSelector
)
1880 DuplicateSpdSelector (
1881 (EFI_IPSEC_CONFIG_SELECTOR
*) SaData
->SpdSelector
,
1882 (EFI_IPSEC_CONFIG_SELECTOR
*) SadEntry
->Data
->SpdSelector
,
1888 SaData
->SpdSelector
= NULL
;
1891 SaData
->ManualSet
= SadEntry
->Data
->ManualSet
;
1897 return EFI_NOT_FOUND
;
1901 This function lookup the data entry from IPsec PAD. Return the configuration
1902 value of the specified PAD Entry.
1904 @param[in] Selector Pointer to an entry selector which is an identifier
1906 @param[in, out] DataSize On output the size of data returned in Data.
1907 @param[out] Data The buffer to return the contents of the IPsec
1908 configuration data. The type of the data buffer
1909 is associated with the DataType.
1911 @retval EFI_SUCCESS The specified configuration data was obtained successfully.
1912 @retval EFI_NOT_FOUND The configuration data specified by Selector is not found.
1913 @retval EFI_BUFFER_TOO_SMALL The DataSize is too small for the result. DataSize has been
1914 updated with the size needed to complete the request.
1919 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector
,
1920 IN OUT UINTN
*DataSize
,
1924 IPSEC_PAD_ENTRY
*PadEntry
;
1925 LIST_ENTRY
*PadList
;
1927 EFI_IPSEC_PAD_ID
*PadId
;
1928 EFI_IPSEC_PAD_DATA
*PadData
;
1931 PadId
= &Selector
->PadId
;
1932 PadData
= (EFI_IPSEC_PAD_DATA
*) Data
;
1933 PadList
= &mConfigData
[IPsecConfigDataTypePad
];
1935 NET_LIST_FOR_EACH (Entry
, PadList
) {
1936 PadEntry
= IPSEC_PAD_ENTRY_FROM_LIST (Entry
);
1939 // Find the required pad entry.
1942 (EFI_IPSEC_CONFIG_SELECTOR
*) PadId
,
1943 (EFI_IPSEC_CONFIG_SELECTOR
*) PadEntry
->Id
1946 // Calculate the required size of the pad entry.
1948 RequiredSize
= ALIGN_VARIABLE (sizeof (EFI_IPSEC_PAD_DATA
));
1949 RequiredSize
= ALIGN_VARIABLE (RequiredSize
+ PadEntry
->Data
->AuthDataSize
);
1950 RequiredSize
+= PadEntry
->Data
->RevocationDataSize
;
1952 if (*DataSize
< RequiredSize
) {
1953 *DataSize
= RequiredSize
;
1954 return EFI_BUFFER_TOO_SMALL
;
1957 // Fill the data fields of pad entry
1959 *DataSize
= RequiredSize
;
1960 PadData
->AuthProtocol
= PadEntry
->Data
->AuthProtocol
;
1961 PadData
->AuthMethod
= PadEntry
->Data
->AuthMethod
;
1962 PadData
->IkeIdFlag
= PadEntry
->Data
->IkeIdFlag
;
1965 // Copy Authentication data.
1967 if (PadEntry
->Data
->AuthData
!= NULL
) {
1969 PadData
->AuthDataSize
= PadEntry
->Data
->AuthDataSize
;
1970 PadData
->AuthData
= (VOID
*) ALIGN_POINTER ((PadData
+ 1), sizeof (UINTN
));
1973 PadEntry
->Data
->AuthData
,
1974 PadData
->AuthDataSize
1978 PadData
->AuthDataSize
= 0;
1979 PadData
->AuthData
= NULL
;
1982 // Copy Revocation Data.
1984 if (PadEntry
->Data
->RevocationData
!= NULL
) {
1986 PadData
->RevocationDataSize
= PadEntry
->Data
->RevocationDataSize
;
1987 PadData
->RevocationData
= (VOID
*) ALIGN_POINTER (
1988 ((UINT8
*) (PadData
+ 1) + PadData
->AuthDataSize
),
1992 PadData
->RevocationData
,
1993 PadEntry
->Data
->RevocationData
,
1994 PadData
->RevocationDataSize
1998 PadData
->RevocationDataSize
= 0;
1999 PadData
->RevocationData
= NULL
;
2006 return EFI_NOT_FOUND
;
2010 Copy Source Process Policy to the Destination Process Policy.
2012 @param[in] Dst Pointer to the Source Process Policy.
2013 @param[in] Src Pointer to the Destination Process Policy.
2017 IpSecDuplicateProcessPolicy (
2018 IN EFI_IPSEC_PROCESS_POLICY
*Dst
,
2019 IN EFI_IPSEC_PROCESS_POLICY
*Src
2023 // Firstly copy the structure content itself.
2025 CopyMem (Dst
, Src
, sizeof (EFI_IPSEC_PROCESS_POLICY
));
2028 // Recursively copy the tunnel option if needed.
2030 if (Dst
->Mode
!= EfiIPsecTunnel
) {
2031 ASSERT (Dst
->TunnelOption
== NULL
);
2033 Dst
->TunnelOption
= (EFI_IPSEC_TUNNEL_OPTION
*) ALIGN_POINTER ((Dst
+ 1), sizeof (UINTN
));
2037 sizeof (EFI_IPSEC_TUNNEL_OPTION
)
2043 Calculate the a whole size of EFI_IPSEC_SPD_DATA, which includes the buffer size pointed
2044 to by the pointer members.
2046 @param[in] SpdData Pointer to a specified EFI_IPSEC_SPD_DATA.
2048 @return the whole size the specified EFI_IPSEC_SPD_DATA.
2052 IpSecGetSizeOfEfiSpdData (
2053 IN EFI_IPSEC_SPD_DATA
*SpdData
2058 Size
= ALIGN_VARIABLE (sizeof (IPSEC_SPD_DATA
));
2060 if (SpdData
->Action
== EfiIPsecActionProtect
) {
2061 Size
= ALIGN_VARIABLE (Size
+ sizeof (EFI_IPSEC_PROCESS_POLICY
));
2063 if (SpdData
->ProcessingPolicy
->Mode
== EfiIPsecTunnel
) {
2064 Size
= ALIGN_VARIABLE (Size
+ sizeof (EFI_IPSEC_TUNNEL_OPTION
));
2072 Calculate the a whole size of IPSEC_SPD_DATA which includes the buffer size pointed
2073 to by the pointer members and the buffer size used by the Sa List.
2075 @param[in] SpdData Pointer to the specified IPSEC_SPD_DATA.
2077 @return the whole size of IPSEC_SPD_DATA.
2081 IpSecGetSizeOfSpdData (
2082 IN IPSEC_SPD_DATA
*SpdData
2088 Size
= sizeof (EFI_IPSEC_SPD_DATA
) - sizeof (EFI_IPSEC_SA_ID
);
2090 if (SpdData
->Action
== EfiIPsecActionProtect
) {
2091 Size
+= sizeof (EFI_IPSEC_PROCESS_POLICY
);
2093 if (SpdData
->ProcessingPolicy
->Mode
== EfiIPsecTunnel
) {
2094 Size
+= sizeof (EFI_IPSEC_TUNNEL_OPTION
);
2098 NET_LIST_FOR_EACH (Link
, &SpdData
->Sas
) {
2099 Size
+= sizeof (EFI_IPSEC_SA_ID
);
2106 Get the IPsec Variable.
2108 Get the all variables which start with the string contained in VaraiableName.
2109 Since all IPsec related variable store in continual space, those kinds of
2110 variable can be searched by the EfiGetNextVariableName. Those variables also are
2111 returned in a continual buffer.
2113 @param[in] VariableName Pointer to a specified Variable Name.
2114 @param[in] VendorGuid Pointer to a specified Vendor Guid.
2115 @param[in] Attributes Point to memory location to return the attributes
2116 of variable. If the point is NULL, the parameter
2118 @param[in, out] DataSize As input, point to the maximum size of return
2119 Data-Buffer. As output, point to the actual
2120 size of the returned Data-Buffer.
2121 @param[in] Data Point to return Data-Buffer.
2123 @retval EFI_ABORTED If the Variable size which contained in the variable
2124 structure doesn't match the variable size obtained
2125 from the EFIGetVariable.
2126 @retval EFI_BUFFER_TOO_SMALL The DataSize is too small for the result. DataSize has
2127 been updated with the size needed to complete the request.
2128 @retval EFI_SUCCESS The function completed successfully.
2129 @retval others Other errors found during the variable getting.
2133 IN CHAR16
*VariableName
,
2134 IN EFI_GUID
*VendorGuid
,
2135 IN UINT32
*Attributes
, OPTIONAL
2136 IN OUT UINTN
*DataSize
,
2141 EFI_GUID VendorGuidI
;
2142 UINTN VariableNameLength
;
2143 CHAR16
*VariableNameI
;
2144 UINTN VariableNameISize
;
2145 UINTN VariableNameISizeNew
;
2146 UINTN VariableIndex
;
2147 UINTN VariableCount
;
2148 IP_SEC_VARIABLE_INFO IpSecVariableInfo
;
2152 // The variable name constructor is "VariableName + Info/0001/0002/... + NULL".
2153 // So the varialbe name is like "VariableNameInfo", "VariableName0001", ...
2154 // "VariableNameNULL".
2156 VariableNameLength
= StrLen (VariableName
);
2157 VariableNameISize
= (VariableNameLength
+ 5) * sizeof (CHAR16
);
2158 VariableNameI
= AllocateZeroPool (VariableNameISize
);
2159 ASSERT (VariableNameI
!= NULL
);
2162 // Construct the varible name of ipsecconfig meta data.
2164 UnicodeSPrint (VariableNameI
, VariableNameISize
, L
"%s%s", VariableName
, L
"Info");
2166 DataSizeI
= sizeof (IpSecVariableInfo
);
2168 Status
= gRT
->GetVariable (
2175 if (EFI_ERROR (Status
)) {
2179 if (*DataSize
< IpSecVariableInfo
.VariableSize
) {
2180 *DataSize
= IpSecVariableInfo
.VariableSize
;
2181 Status
= EFI_BUFFER_TOO_SMALL
;
2185 VariableCount
= IpSecVariableInfo
.VariableCount
;
2186 VariableNameI
[0] = L
'\0';
2188 while (VariableCount
!= 0) {
2190 // Get the variable name one by one in the variable database.
2192 VariableNameISizeNew
= VariableNameISize
;
2193 Status
= gRT
->GetNextVariableName (
2194 &VariableNameISizeNew
,
2198 if (Status
== EFI_BUFFER_TOO_SMALL
) {
2199 VariableNameI
= ReallocatePool (
2201 VariableNameISizeNew
,
2204 if (VariableNameI
== NULL
) {
2205 Status
= EFI_OUT_OF_RESOURCES
;
2208 VariableNameISize
= VariableNameISizeNew
;
2210 Status
= gRT
->GetNextVariableName (
2211 &VariableNameISizeNew
,
2217 if (EFI_ERROR (Status
)) {
2221 // Check whether the current variable is the required "ipsecconfig".
2223 if (StrnCmp (VariableNameI
, VariableName
, VariableNameLength
) == 0 ||
2224 CompareGuid (VendorGuid
, &VendorGuidI
)
2227 // Parse the variable count of the current ipsecconfig data.
2229 VariableIndex
= StrDecimalToUintn (VariableNameI
+ VariableNameLength
);
2230 if (VariableIndex
!= 0 && VariableIndex
<= IpSecVariableInfo
.VariableCount
) {
2232 // Get the variable size of the current ipsecconfig data.
2235 Status
= gRT
->GetVariable (
2242 ASSERT (Status
== EFI_BUFFER_TOO_SMALL
);
2244 // Validate the variable count and variable size.
2246 if (VariableIndex
!= IpSecVariableInfo
.VariableCount
) {
2248 // If the varaibe is not the last one, its size should be the max
2249 // size of the single variable.
2251 if (DataSizeI
!= IpSecVariableInfo
.SingleVariableSize
) {
2255 if (DataSizeI
!= IpSecVariableInfo
.VariableSize
% IpSecVariableInfo
.SingleVariableSize
) {
2260 // Get the variable data of the current ipsecconfig data and
2261 // store it into user buffer continously.
2263 Status
= gRT
->GetVariable (
2268 (UINT8
*) Data
+ (VariableIndex
- 1) * IpSecVariableInfo
.SingleVariableSize
2270 ASSERT_EFI_ERROR (Status
);
2276 // The VariableCount in "VariableNameInfo" varaible should have the correct
2277 // numbers of variables which name starts with VariableName.
2279 if (VariableCount
!= 0) {
2280 Status
= EFI_ABORTED
;
2284 if (VariableNameI
!= NULL
) {
2285 FreePool (VariableNameI
);
2291 Set the IPsec variables.
2293 Set all IPsec variables which start with the specified variable name. Those variables
2296 @param[in] VariableName The name of the vendor's variable. It is a
2297 Null-Terminated Unicode String.
2298 @param[in] VendorGuid Unify identifier for vendor.
2299 @param[in] Attributes Point to memory location to return the attributes of
2300 variable. If the point is NULL, the parameter would be ignored.
2301 @param[in] DataSize The size in bytes of Data-Buffer.
2302 @param[in] Data Points to the content of the variable.
2304 @retval EFI_SUCCESS The firmware successfully stored the variable and its data, as
2305 defined by the Attributes.
2306 @retval others Storing the variables failed.
2311 IN CHAR16
*VariableName
,
2312 IN EFI_GUID
*VendorGuid
,
2313 IN UINT32 Attributes
,
2319 CHAR16
*VariableNameI
;
2320 UINTN VariableNameSize
;
2321 UINTN VariableIndex
;
2322 IP_SEC_VARIABLE_INFO IpSecVariableInfo
;
2323 UINT64 MaximumVariableStorageSize
;
2324 UINT64 RemainingVariableStorageSize
;
2325 UINT64 MaximumVariableSize
;
2327 Status
= gRT
->QueryVariableInfo (
2329 &MaximumVariableStorageSize
,
2330 &RemainingVariableStorageSize
,
2331 &MaximumVariableSize
2333 if (EFI_ERROR (Status
)) {
2338 // "VariableName + Info/0001/0002/... + NULL"
2340 VariableNameSize
= (StrLen (VariableName
) + 5) * sizeof (CHAR16
);
2341 VariableNameI
= AllocateZeroPool (VariableNameSize
);
2343 if (VariableNameI
== NULL
) {
2344 Status
= EFI_OUT_OF_RESOURCES
;
2348 // Construct the variable of ipsecconfig general information. Like the total
2349 // numbers of the Ipsecconfig variables, the total size of all ipsecconfig variables.
2351 UnicodeSPrint (VariableNameI
, VariableNameSize
, L
"%s%s", VariableName
, L
"Info");
2352 MaximumVariableSize
-= VariableNameSize
;
2354 IpSecVariableInfo
.VariableCount
= (UINT32
) ((DataSize
+ (UINTN
) MaximumVariableSize
- 1) / (UINTN
) MaximumVariableSize
);
2355 IpSecVariableInfo
.VariableSize
= (UINT32
) DataSize
;
2356 IpSecVariableInfo
.SingleVariableSize
= (UINT32
) MaximumVariableSize
;
2359 // Set the variable of ipsecconfig general information.
2361 Status
= gRT
->SetVariable (
2365 sizeof (IpSecVariableInfo
),
2368 if (EFI_ERROR (Status
)) {
2369 DEBUG ((DEBUG_ERROR
, "Error set ipsecconfig meta data with %r\n", Status
));
2373 for (VariableIndex
= 0; VariableIndex
< IpSecVariableInfo
.VariableCount
; VariableIndex
++) {
2375 // Construct and set the variable of ipsecconfig data one by one.
2376 // The index of variable name begin from 0001, and the varaible name
2377 // likes "VariableName0001", "VaraiableName0002"....
2379 UnicodeSPrint (VariableNameI
, VariableNameSize
, L
"%s%04d", VariableName
, VariableIndex
+ 1);
2380 Status
= gRT
->SetVariable (
2384 (VariableIndex
== IpSecVariableInfo
.VariableCount
- 1) ?
2385 (DataSize
% (UINTN
) MaximumVariableSize
) :
2386 (UINTN
) MaximumVariableSize
,
2387 (UINT8
*) Data
+ VariableIndex
* (UINTN
) MaximumVariableSize
2390 if (EFI_ERROR (Status
)) {
2391 DEBUG ((DEBUG_ERROR
, "Error set ipsecconfig variable data with %r\n", Status
));
2397 if (VariableNameI
!= NULL
) {
2398 FreePool (VariableNameI
);
2405 Return the configuration value for the EFI IPsec driver.
2407 This function lookup the data entry from IPsec database or IKEv2 configuration
2408 information. The expected data type and unique identification are described in
2409 DataType and Selector parameters.
2411 @param[in] This Pointer to the EFI_IPSEC_CONFIG_PROTOCOL instance.
2412 @param[in] DataType The type of data to retrieve.
2413 @param[in] Selector Pointer to an entry selector that is an identifier of the IPsec
2414 configuration data entry.
2415 @param[in, out] DataSize On output the size of data returned in Data.
2416 @param[out] Data The buffer to return the contents of the IPsec configuration data.
2417 The type of the data buffer associated with the DataType.
2419 @retval EFI_SUCCESS The specified configuration data was obtained successfully.
2420 @retval EFI_INVALID_PARAMETER One or more of the followings are TRUE:
2424 - Data is NULL and *DataSize is not zero
2425 @retval EFI_NOT_FOUND The configuration data specified by Selector is not found.
2426 @retval EFI_UNSUPPORTED The specified DataType is not supported.
2427 @retval EFI_BUFFER_TOO_SMALL The DataSize is too small for the result. DataSize has been
2428 updated with the size needed to complete the request.
2433 EfiIpSecConfigGetData (
2434 IN EFI_IPSEC_CONFIG_PROTOCOL
*This
,
2435 IN EFI_IPSEC_CONFIG_DATA_TYPE DataType
,
2436 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector
,
2437 IN OUT UINTN
*DataSize
,
2441 if (This
== NULL
|| Selector
== NULL
|| DataSize
== NULL
) {
2442 return EFI_INVALID_PARAMETER
;
2445 if (*DataSize
!= 0 && Data
== NULL
) {
2446 return EFI_INVALID_PARAMETER
;
2449 if (DataType
>= IPsecConfigDataTypeMaximum
) {
2450 return EFI_UNSUPPORTED
;
2453 return mGetPolicyEntry
[DataType
](Selector
, DataSize
, Data
);
2457 Set the security association, security policy and peer authorization configuration
2458 information for the EFI IPsec driver.
2460 This function is used to set the IPsec configuration information of type DataType for
2461 the EFI IPsec driver.
2462 The IPsec configuration data has a unique selector/identifier separately to identify
2463 a data entry. The selector structure depends on DataType's definition.
2464 Using SetData() with a Data of NULL causes the IPsec configuration data entry identified
2465 by DataType and Selector to be deleted.
2467 @param[in] This Pointer to the EFI_IPSEC_CONFIG_PROTOCOL instance.
2468 @param[in] DataType The type of data to be set.
2469 @param[in] Selector Pointer to an entry selector on operated configuration data
2470 specified by DataType. A NULL Selector causes the entire
2471 specified-type configuration information to be flushed.
2472 @param[in] Data The data buffer to be set. The structure of the data buffer is
2473 associated with the DataType.
2474 @param[in] InsertBefore Pointer to one entry selector which describes the expected
2475 position the new data entry will be added. If InsertBefore is NULL,
2476 the new entry will be appended to the end of the database.
2478 @retval EFI_SUCCESS The specified configuration entry data was set successfully.
2479 @retval EFI_INVALID_PARAMETER One or more of the following are TRUE:
2481 @retval EFI_UNSUPPORTED The specified DataType is not supported.
2482 @retval EFI_OUT_OF_RESOURCED The required system resource could not be allocated.
2487 EfiIpSecConfigSetData (
2488 IN EFI_IPSEC_CONFIG_PROTOCOL
*This
,
2489 IN EFI_IPSEC_CONFIG_DATA_TYPE DataType
,
2490 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector
,
2492 IN EFI_IPSEC_CONFIG_SELECTOR
*InsertBefore OPTIONAL
2498 return EFI_INVALID_PARAMETER
;
2501 if (DataType
>= IPsecConfigDataTypeMaximum
) {
2502 return EFI_UNSUPPORTED
;
2505 Status
= mSetPolicyEntry
[DataType
](Selector
, Data
, InsertBefore
);
2507 if (!EFI_ERROR (Status
) && !mSetBySelf
) {
2509 // Save the updated config data into variable.
2518 Enumerates the current selector for IPsec configuration data entry.
2520 This function is called multiple times to retrieve the entry Selector in IPsec
2521 configuration database. On each call to GetNextSelector(), the next entry
2522 Selector are retrieved into the output interface.
2524 If the entire IPsec configuration database has been iterated, the error
2525 EFI_NOT_FOUND is returned.
2526 If the Selector buffer is too small for the next Selector copy, an
2527 EFI_BUFFER_TOO_SMALL error is returned, and SelectorSize is updated to reflect
2528 the size of buffer needed.
2530 On the initial call to GetNextSelector() to start the IPsec configuration database
2531 search, a pointer to the buffer with all zero value is passed in Selector. Calls
2532 to SetData() between calls to GetNextSelector may produce unpredictable results.
2534 @param[in] This Pointer to the EFI_IPSEC_CONFIG_PROTOCOL instance.
2535 @param[in] DataType The type of IPsec configuration data to retrieve.
2536 @param[in, out] SelectorSize The size of the Selector buffer.
2537 @param[in, out] Selector On input, supplies the pointer to last Selector that was
2538 returned by GetNextSelector().
2539 On output, returns one copy of the current entry Selector
2540 of a given DataType.
2542 @retval EFI_SUCCESS The specified configuration data was obtained successfully.
2543 @retval EFI_INVALID_PARAMETER One or more of the followings are TRUE:
2545 - SelectorSize is NULL.
2547 @retval EFI_NOT_FOUND The next configuration data entry was not found.
2548 @retval EFI_UNSUPPORTED The specified DataType is not supported.
2549 @retval EFI_BUFFER_TOO_SMALL The SelectorSize is too small for the result. This parameter
2550 has been updated with the size needed to complete the search
2556 EfiIpSecConfigGetNextSelector (
2557 IN EFI_IPSEC_CONFIG_PROTOCOL
*This
,
2558 IN EFI_IPSEC_CONFIG_DATA_TYPE DataType
,
2559 IN OUT UINTN
*SelectorSize
,
2560 IN OUT EFI_IPSEC_CONFIG_SELECTOR
*Selector
2564 IPSEC_COMMON_POLICY_ENTRY
*CommonEntry
;
2567 if (This
== NULL
|| Selector
== NULL
|| SelectorSize
== NULL
) {
2568 return EFI_INVALID_PARAMETER
;
2571 if (DataType
>= IPsecConfigDataTypeMaximum
) {
2572 return EFI_UNSUPPORTED
;
2577 NET_LIST_FOR_EACH (Link
, &mConfigData
[DataType
]) {
2578 CommonEntry
= BASE_CR (Link
, IPSEC_COMMON_POLICY_ENTRY
, List
);
2580 if (IsFound
|| (BOOLEAN
)(mIsZeroSelector
[DataType
](Selector
))) {
2582 // If found the appointed entry, then duplicate the next one and return,
2583 // or if the appointed entry is zero, then return the first one directly.
2585 return mDuplicateSelector
[DataType
](Selector
, CommonEntry
->Selector
, SelectorSize
);
2588 // Set the flag if find the appointed entry.
2590 IsFound
= mCompareSelector
[DataType
](Selector
, CommonEntry
->Selector
);
2594 return EFI_NOT_FOUND
;
2598 Register an event that is to be signaled whenever a configuration process on the
2599 specified IPsec configuration information is done.
2601 The register function is not surpport now and always returns EFI_UNSUPPORTED.
2603 @param[in] This Pointer to the EFI_IPSEC_CONFIG_PROTOCOL instance.
2604 @param[in] DataType The type of data to be registered the event for.
2605 @param[in] Event The event to be registered.
2607 @retval EFI_SUCCESS The event is registered successfully.
2608 @retval EFI_INVALID_PARAMETER This is NULL or Event is NULL.
2609 @retval EFI_ACCESS_DENIED The Event is already registered for the DataType.
2610 @retval EFI_UNSUPPORTED The notify registration is unsupported, or the specified
2611 DataType is not supported.
2616 EfiIpSecConfigRegisterNotify (
2617 IN EFI_IPSEC_CONFIG_PROTOCOL
*This
,
2618 IN EFI_IPSEC_CONFIG_DATA_TYPE DataType
,
2622 return EFI_UNSUPPORTED
;
2626 Remove the specified event that was previously registered on the specified IPsec
2629 This function is not support now and alwasy return EFI_UNSUPPORTED.
2631 @param[in] This Pointer to the EFI_IPSEC_CONFIG_PROTOCOL instance.
2632 @param[in] DataType The configuration data type to remove the registered event for.
2633 @param[in] Event The event to be unregistered.
2635 @retval EFI_SUCCESS The event was removed successfully.
2636 @retval EFI_NOT_FOUND The Event specified by DataType could not be found in the
2638 @retval EFI_INVALID_PARAMETER This is NULL or Event is NULL.
2639 @retval EFI_UNSUPPORTED The notify registration is unsupported, or the specified
2640 DataType is not supported.
2645 EfiIpSecConfigUnregisterNotify (
2646 IN EFI_IPSEC_CONFIG_PROTOCOL
*This
,
2647 IN EFI_IPSEC_CONFIG_DATA_TYPE DataType
,
2651 return EFI_UNSUPPORTED
;
2655 Copy whole data in specified EFI_SIPEC_CONFIG_SELECTOR and the Data to a buffer.
2657 This function is a caller defined function, and it is called by the IpSecVisitConfigData().
2658 The orignal caller is IpSecConfigSave(), which calls the IpsecVisitConfigData() to
2659 copy all types of IPsec Config datas into one buffer and store this buffer into firmware in
2660 the form of several variables.
2662 @param[in] Type A specified IPSEC_CONFIG_DATA_TYPE.
2663 @param[in] Selector Points to a EFI_IPSEC_CONFIG_SELECTOR to be copied
2665 @param[in] Data Points to data to be copied to the buffer. The
2666 Data type is related to the Type.
2667 @param[in] SelectorSize The size of the Selector.
2668 @param[in] DataSize The size of the Data.
2669 @param[in, out] Buffer The buffer to store the Selector and Data.
2671 @retval EFI_SUCCESS Copy the Selector and Data to a buffer successfully.
2672 @retval EFI_OUT_OF_RESOURCES The required system resource could not be allocated.
2676 IpSecCopyPolicyEntry (
2677 IN EFI_IPSEC_CONFIG_DATA_TYPE Type
,
2678 IN EFI_IPSEC_CONFIG_SELECTOR
*Selector
,
2680 IN UINTN SelectorSize
,
2682 IN OUT IPSEC_VARIABLE_BUFFER
*Buffer
2685 IPSEC_VAR_ITEM_HEADER SelectorHeader
;
2686 IPSEC_VAR_ITEM_HEADER DataHeader
;
2690 if (Type
== IPsecConfigDataTypeSad
) {
2692 // Don't save automatically-generated SA entry into variable.
2694 if (((EFI_IPSEC_SA_DATA2
*) Data
)->ManualSet
== FALSE
) {
2699 // Increase the capacity size of the buffer if needed.
2701 EntrySize
= ALIGN_VARIABLE (sizeof (SelectorHeader
));
2702 EntrySize
= ALIGN_VARIABLE (EntrySize
+ SelectorSize
);
2703 EntrySize
= ALIGN_VARIABLE (EntrySize
+ sizeof (SelectorHeader
));
2704 EntrySize
= ALIGN_VARIABLE (EntrySize
+ DataSize
);
2706 //EntrySize = SelectorSize + DataSize + 2 * sizeof (SelectorHeader);
2707 if (Buffer
->Capacity
- Buffer
->Size
< EntrySize
) {
2709 // Calculate the required buffer
2711 Buffer
->Capacity
+= EntrySize
;
2712 TempPoint
= AllocatePool (Buffer
->Capacity
);
2714 if (TempPoint
== NULL
) {
2715 return EFI_OUT_OF_RESOURCES
;
2718 // Copy the old Buffer to new buffer and free the old one.
2720 CopyMem (TempPoint
, Buffer
->Ptr
, Buffer
->Size
);
2721 FreePool (Buffer
->Ptr
);
2723 Buffer
->Ptr
= TempPoint
;
2726 mFixPolicyEntry
[Type
](Selector
, Data
);
2729 // Fill the selector header and copy it into buffer.
2731 SelectorHeader
.Type
= (UINT8
) (Type
| IPSEC_VAR_ITEM_HEADER_LOGO_BIT
);
2732 SelectorHeader
.Size
= (UINT16
) SelectorSize
;
2735 Buffer
->Ptr
+ Buffer
->Size
,
2737 sizeof (SelectorHeader
)
2739 Buffer
->Size
= ALIGN_VARIABLE (Buffer
->Size
+ sizeof (SelectorHeader
));
2742 // Copy the selector into buffer.
2745 Buffer
->Ptr
+ Buffer
->Size
,
2749 Buffer
->Size
= ALIGN_VARIABLE (Buffer
->Size
+ SelectorSize
);
2752 // Fill the data header and copy it into buffer.
2754 DataHeader
.Type
= (UINT8
) Type
;
2755 DataHeader
.Size
= (UINT16
) DataSize
;
2758 Buffer
->Ptr
+ Buffer
->Size
,
2762 Buffer
->Size
= ALIGN_VARIABLE (Buffer
->Size
+ sizeof (DataHeader
));
2764 // Copy the data into buffer.
2767 Buffer
->Ptr
+ Buffer
->Size
,
2771 Buffer
->Size
= ALIGN_VARIABLE (Buffer
->Size
+ DataSize
);
2773 mUnfixPolicyEntry
[Type
](Selector
, Data
);
2779 Visit all IPsec Configurations of specified Type and call the caller defined
2782 @param[in] DataType The specified IPsec Config Data Type.
2783 @param[in] Routine The function defined by the caller.
2784 @param[in] Context The data passed to the Routine.
2786 @retval EFI_OUT_OF_RESOURCES The required system resource could not be allocated
2787 @retval EFI_SUCCESS This function completed successfully.
2791 IpSecVisitConfigData (
2792 IN EFI_IPSEC_CONFIG_DATA_TYPE DataType
,
2793 IN IPSEC_COPY_POLICY_ENTRY Routine
,
2797 EFI_STATUS GetNextStatus
;
2798 EFI_STATUS GetDataStatus
;
2799 EFI_STATUS RoutineStatus
;
2800 EFI_IPSEC_CONFIG_SELECTOR
*Selector
;
2804 UINTN SelectorBufferSize
;
2805 UINTN DataBufferSize
;
2806 BOOLEAN FirstGetNext
;
2808 FirstGetNext
= TRUE
;
2811 SelectorBufferSize
= sizeof (EFI_IPSEC_CONFIG_SELECTOR
);
2812 Selector
= AllocateZeroPool (SelectorBufferSize
);
2814 if (Selector
== NULL
) {
2815 return EFI_OUT_OF_RESOURCES
;
2820 // Get the real size of the selector.
2822 SelectorSize
= SelectorBufferSize
;
2823 GetNextStatus
= EfiIpSecConfigGetNextSelector (
2824 &mIpSecConfigInstance
,
2829 if (GetNextStatus
== EFI_BUFFER_TOO_SMALL
) {
2830 FreePool (Selector
);
2831 SelectorBufferSize
= SelectorSize
;
2833 // Allocate zero pool for the first selector, while store the last
2834 // selector content for the other selectors.
2837 Selector
= AllocateZeroPool (SelectorBufferSize
);
2839 Selector
= AllocateCopyPool (SelectorBufferSize
, Selector
);
2842 if (Selector
== NULL
) {
2843 return EFI_OUT_OF_RESOURCES
;
2846 // Get the content of the selector.
2848 GetNextStatus
= EfiIpSecConfigGetNextSelector (
2849 &mIpSecConfigInstance
,
2856 if (EFI_ERROR (GetNextStatus
)) {
2860 FirstGetNext
= FALSE
;
2863 // Get the real size of the policy entry according to the selector.
2865 DataSize
= DataBufferSize
;
2866 GetDataStatus
= EfiIpSecConfigGetData (
2867 &mIpSecConfigInstance
,
2873 if (GetDataStatus
== EFI_BUFFER_TOO_SMALL
) {
2878 DataBufferSize
= DataSize
;
2879 Data
= AllocateZeroPool (DataBufferSize
);
2882 return EFI_OUT_OF_RESOURCES
;
2885 // Get the content of the policy entry according to the selector.
2887 GetDataStatus
= EfiIpSecConfigGetData (
2888 &mIpSecConfigInstance
,
2896 if (EFI_ERROR (GetDataStatus
)) {
2900 // Prepare the buffer of updated policy entry, which is stored in
2901 // the continous memory, and then save into variable later.
2903 RoutineStatus
= Routine (
2911 if (EFI_ERROR (RoutineStatus
)) {
2920 if (Selector
!= NULL
) {
2921 FreePool (Selector
);
2928 This function is the subfunction of EFIIpSecConfigSetData.
2930 This function call IpSecSetVaraible to set the IPsec Configuration into the firmware.
2932 @retval EFI_OUT_OF_RESOURCES The required system resource could not be allocated.
2933 @retval EFI_SUCCESS Saved the configration successfully.
2934 @retval Others Other errors were found while obtaining the variable.
2942 IPSEC_VARIABLE_BUFFER Buffer
;
2944 EFI_IPSEC_CONFIG_DATA_TYPE Type
;
2947 Buffer
.Capacity
= IPSEC_DEFAULT_VARIABLE_SIZE
;
2948 Buffer
.Ptr
= AllocateZeroPool (Buffer
.Capacity
);
2950 if (Buffer
.Ptr
== NULL
) {
2951 return EFI_OUT_OF_RESOURCES
;
2954 // For each policy database, prepare the contious buffer to save into variable.
2956 for (Type
= IPsecConfigDataTypeSpd
; Type
< IPsecConfigDataTypeMaximum
; Type
++) {
2957 IpSecVisitConfigData (
2959 (IPSEC_COPY_POLICY_ENTRY
) IpSecCopyPolicyEntry
,
2964 // Save the updated policy database into variable.
2966 Status
= IpSecSetVariable (
2967 IPSECCONFIG_VARIABLE_NAME
,
2968 &gEfiIpSecConfigProtocolGuid
,
2969 EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_NON_VOLATILE
,
2974 FreePool (Buffer
.Ptr
);
2980 Get the all IPSec configuration variables and store those variables
2981 to the internal data structure.
2983 This founction is called by IpSecConfigInitialize() which is to intialize the
2984 IPsecConfiguration Protocol.
2986 @param[in] Private Point to IPSEC_PRIVATE_DATA.
2988 @retval EFI_OUT_OF_RESOURCES The required system resource could not be allocated
2989 @retval EFI_SUCCESS Restore the IPsec Configuration successfully.
2990 @retval others Other errors is found while obtaining the variable.
2994 IpSecConfigRestore (
2995 IN IPSEC_PRIVATE_DATA
*Private
3001 IPSEC_VAR_ITEM_HEADER
*Header
;
3003 EFI_IPSEC_CONFIG_SELECTOR
*Selector
;
3004 EFI_IPSEC_CONFIG_DATA_TYPE Type
;
3010 Size
= sizeof (Value
);
3014 Status
= gRT
->GetVariable (
3015 IPSECCONFIG_STATUS_NAME
,
3016 &gEfiIpSecConfigProtocolGuid
,
3022 if (!EFI_ERROR (Status
) && Value
== IPSEC_STATUS_ENABLED
) {
3023 Private
->IpSec
.DisabledFlag
= FALSE
;
3026 // Get the real size of policy database in variable.
3028 Status
= IpSecGetVariable (
3029 IPSECCONFIG_VARIABLE_NAME
,
3030 &gEfiIpSecConfigProtocolGuid
,
3035 if (Status
== EFI_BUFFER_TOO_SMALL
) {
3037 Buffer
= AllocateZeroPool (BufferSize
);
3038 if (Buffer
== NULL
) {
3039 return EFI_OUT_OF_RESOURCES
;
3042 // Get the content of policy database in variable.
3044 Status
= IpSecGetVariable (
3045 IPSECCONFIG_VARIABLE_NAME
,
3046 &gEfiIpSecConfigProtocolGuid
,
3051 if (EFI_ERROR (Status
)) {
3056 for (Ptr
= Buffer
; Ptr
< Buffer
+ BufferSize
;) {
3058 Header
= (IPSEC_VAR_ITEM_HEADER
*) Ptr
;
3059 Type
= (EFI_IPSEC_CONFIG_DATA_TYPE
) (Header
->Type
& IPSEC_VAR_ITEM_HEADER_CONTENT_BIT
);
3060 ASSERT (((Header
->Type
& 0x80) == IPSEC_VAR_ITEM_HEADER_LOGO_BIT
) && (Type
< IPsecConfigDataTypeMaximum
));
3062 Selector
= (EFI_IPSEC_CONFIG_SELECTOR
*) ALIGN_POINTER (Header
+ 1, sizeof (UINTN
));
3063 Header
= (IPSEC_VAR_ITEM_HEADER
*) ALIGN_POINTER (
3064 (UINT8
*) Selector
+ Header
->Size
,
3067 ASSERT (Header
->Type
== Type
);
3069 Data
= ALIGN_POINTER (Header
+ 1, sizeof (UINTN
));
3071 mUnfixPolicyEntry
[Type
](Selector
, Data
);
3074 // Update each policy entry according to the content in variable.
3077 Status
= EfiIpSecConfigSetData (
3078 &Private
->IpSecConfig
,
3086 if (EFI_ERROR (Status
)) {
3091 Ptr
= ALIGN_POINTER ((UINT8
*) Data
+ Header
->Size
, sizeof (UINTN
));
3101 Install and Initialize IPsecConfig protocol
3103 @param[in, out] Private Pointer to IPSEC_PRIVATE_DATA. After this function finish,
3104 the pointer of IPsecConfig Protocol implementation will copy
3105 into its IPsecConfig member.
3107 @retval EFI_SUCCESS Initialized the IPsecConfig Protocol successfully.
3108 @retval Others Initializing the IPsecConfig Protocol failed.
3111 IpSecConfigInitialize (
3112 IN OUT IPSEC_PRIVATE_DATA
*Private
3115 EFI_IPSEC_CONFIG_DATA_TYPE Type
;
3118 &Private
->IpSecConfig
,
3119 &mIpSecConfigInstance
,
3120 sizeof (EFI_IPSEC_CONFIG_PROTOCOL
)
3124 // Initialize the list head of policy database.
3126 for (Type
= IPsecConfigDataTypeSpd
; Type
< IPsecConfigDataTypeMaximum
; Type
++) {
3127 InitializeListHead (&mConfigData
[Type
]);
3130 // Restore the content of policy database according to the variable.
3132 IpSecConfigRestore (Private
);
3134 return gBS
->InstallMultipleProtocolInterfaces (
3136 &gEfiIpSecConfigProtocolGuid
,
3137 &Private
->IpSecConfig
,