NetworkPkg/TlsDxe/TlsProtocol.c

   1 /** @file
   2   Implementation of EFI TLS Protocol Interfaces.
   3
   4   Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
   5
   6   This program and the accompanying materials
   7   are licensed and made available under the terms and conditions of the BSD License
   8   which accompanies this distribution.  The full text of the license may be found at
   9   http://opensource.org/licenses/bsd-license.php.
  10
  11   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  12   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  13
  14 **/
  15
  16 #include "TlsImpl.h"
  17
  18 EFI_TLS_PROTOCOL  mTlsProtocol = {
  19   TlsSetSessionData,
  20   TlsGetSessionData,
  21   TlsBuildResponsePacket,
  22   TlsProcessPacket
  23 };
  24
  25 /**
  26   Set TLS session data.
  27
  28   The SetSessionData() function set data for a new TLS session. All session data should
  29   be set before BuildResponsePacket() invoked.
  30
  31   @param[in]  This                Pointer to the EFI_TLS_PROTOCOL instance.
  32   @param[in]  DataType            TLS session data type.
  33   @param[in]  Data                Pointer to session data.
  34   @param[in]  DataSize            Total size of session data.
  35
  36   @retval EFI_SUCCESS             The TLS session data is set successfully.
  37   @retval EFI_INVALID_PARAMETER   One or more of the following conditions is TRUE:
  38                                   This is NULL.
  39                                   Data is NULL.
  40                                   DataSize is 0.
  41                                   DataSize is invalid for DataType.
  42   @retval EFI_UNSUPPORTED         The DataType is unsupported.
  43   @retval EFI_ACCESS_DENIED       If the DataType is one of below:
  44                                   EfiTlsClientRandom
  45                                   EfiTlsServerRandom
  46                                   EfiTlsKeyMaterial
  47   @retval EFI_NOT_READY           Current TLS session state is NOT
  48                                   EfiTlsSessionStateNotStarted.
  49   @retval EFI_OUT_OF_RESOURCES    Required system resources could not be allocated.
  50 **/
  51 EFI_STATUS
  52 EFIAPI
  53 TlsSetSessionData (
  54   IN     EFI_TLS_PROTOCOL              *This,
  55   IN     EFI_TLS_SESSION_DATA_TYPE     DataType,
  56   IN     VOID                          *Data,
  57   IN     UINTN                         DataSize
  58   )
  59 {
  60   EFI_STATUS                Status;
  61   TLS_INSTANCE              *Instance;
  62   UINT16                    *CipherId;
  63   UINTN                     CipherCount;
  64   UINTN                     Index;
  65
  66   EFI_TPL                   OldTpl;
  67
  68   Status = EFI_SUCCESS;
  69   CipherId = NULL;
  70
  71   if (This == NULL || Data == NULL || DataSize == 0) {
  72     return EFI_INVALID_PARAMETER;
  73   }
  74
  75   OldTpl = gBS->RaiseTPL (TPL_CALLBACK);
  76
  77   Instance = TLS_INSTANCE_FROM_PROTOCOL (This);
  78
  79   if (DataType != EfiTlsSessionState  && Instance->TlsSessionState != EfiTlsSessionNotStarted){
  80     Status = EFI_NOT_READY;
  81     goto ON_EXIT;
  82   }
  83
  84   switch (DataType) {
  85   //
  86   // Session Configuration
  87   //
  88   case EfiTlsVersion:
  89     if (DataSize != sizeof (EFI_TLS_VERSION)) {
  90       Status = EFI_INVALID_PARAMETER;
  91       goto ON_EXIT;
  92     }
  93
  94     Status = TlsSetVersion (Instance->TlsConn, ((EFI_TLS_VERSION *) Data)->Major, ((EFI_TLS_VERSION *) Data)->Minor);
  95     break;
  96   case EfiTlsConnectionEnd:
  97     if (DataSize != sizeof (EFI_TLS_CONNECTION_END)) {
  98       Status = EFI_INVALID_PARAMETER;
  99       goto ON_EXIT;
 100     }
 101
 102     Status = TlsSetConnectionEnd (Instance->TlsConn, *((EFI_TLS_CONNECTION_END *) Data));
 103     break;
 104   case EfiTlsCipherList:
 105     if (DataSize % sizeof (EFI_TLS_CIPHER) != 0) {
 106       Status = EFI_INVALID_PARAMETER;
 107       goto ON_EXIT;
 108     }
 109
 110     CipherId = AllocatePool (DataSize);
 111     if (CipherId == NULL) {
 112       Status = EFI_OUT_OF_RESOURCES;
 113       goto ON_EXIT;
 114     }
 115
 116     CipherCount = DataSize / sizeof (EFI_TLS_CIPHER);
 117     for (Index = 0; Index < CipherCount; Index++) {
 118       *(CipherId +Index) = HTONS (*(((UINT16 *) Data) + Index));
 119     }
 120
 121     Status = TlsSetCipherList (Instance->TlsConn, CipherId, CipherCount);
 122
 123     FreePool (CipherId);
 124     break;
 125   case EfiTlsCompressionMethod:
 126     //
 127     // TLS seems only define one CompressionMethod.null, which specifies that data exchanged via the
 128     // record protocol will not be compressed.
 129     // More information from OpenSSL: http://www.openssl.org/docs/manmaster/ssl/SSL_COMP_add_compression_method.html
 130     // The TLS RFC does however not specify compression methods or their corresponding identifiers,
 131     // so there is currently no compatible way to integrate compression with unknown peers.
 132     // It is therefore currently not recommended to integrate compression into applications.
 133     // Applications for non-public use may agree on certain compression methods.
 134     // Using different compression methods with the same identifier will lead to connection failure.
 135     //
 136     for (Index = 0; Index < DataSize / sizeof (EFI_TLS_COMPRESSION); Index++) {
 137       Status = TlsSetCompressionMethod (*((UINT8 *) Data + Index));
 138       if (EFI_ERROR (Status)) {
 139         break;
 140       }
 141     }
 142
 143     break;
 144   case EfiTlsExtensionData:
 145     Status = EFI_UNSUPPORTED;
 146     goto ON_EXIT;
 147   case EfiTlsVerifyMethod:
 148     if (DataSize != sizeof (EFI_TLS_VERIFY)) {
 149       Status = EFI_INVALID_PARAMETER;
 150       goto ON_EXIT;
 151     }
 152
 153     TlsSetVerify (Instance->TlsConn, *((UINT32 *) Data));
 154     break;
 155   case EfiTlsSessionID:
 156     if (DataSize != sizeof (EFI_TLS_SESSION_ID)) {
 157       Status = EFI_INVALID_PARAMETER;
 158       goto ON_EXIT;
 159     }
 160
 161     Status = TlsSetSessionId (
 162                Instance->TlsConn,
 163                ((EFI_TLS_SESSION_ID *) Data)->Data,
 164                ((EFI_TLS_SESSION_ID *) Data)->Length
 165                );
 166     break;
 167   case EfiTlsSessionState:
 168     if (DataSize != sizeof (EFI_TLS_SESSION_STATE)) {
 169       Status = EFI_INVALID_PARAMETER;
 170       goto ON_EXIT;
 171     }
 172
 173     Instance->TlsSessionState = *(EFI_TLS_SESSION_STATE *) Data;
 174     break;
 175   //
 176   // Session information
 177   //
 178   case EfiTlsClientRandom:
 179     Status = EFI_ACCESS_DENIED;
 180     break;
 181   case EfiTlsServerRandom:
 182     Status = EFI_ACCESS_DENIED;
 183     break;
 184   case EfiTlsKeyMaterial:
 185     Status = EFI_ACCESS_DENIED;
 186     break;
 187   //
 188   // Unsupported type.
 189   //
 190   default:
 191     Status = EFI_UNSUPPORTED;
 192   }
 193
 194 ON_EXIT:
 195   gBS->RestoreTPL (OldTpl);
 196   return Status;
 197 }
 198
 199 /**
 200   Get TLS session data.
 201
 202   The GetSessionData() function return the TLS session information.
 203
 204   @param[in]       This           Pointer to the EFI_TLS_PROTOCOL instance.
 205   @param[in]       DataType       TLS session data type.
 206   @param[in, out]  Data           Pointer to session data.
 207   @param[in, out]  DataSize       Total size of session data. On input, it means
 208                                   the size of Data buffer. On output, it means the size
 209                                   of copied Data buffer if EFI_SUCCESS, and means the
 210                                   size of desired Data buffer if EFI_BUFFER_TOO_SMALL.
 211
 212   @retval EFI_SUCCESS             The TLS session data is got successfully.
 213   @retval EFI_INVALID_PARAMETER   One or more of the following conditions is TRUE:
 214                                   This is NULL.
 215                                   DataSize is NULL.
 216                                   Data is NULL if *DataSize is not zero.
 217   @retval EFI_UNSUPPORTED         The DataType is unsupported.
 218   @retval EFI_NOT_FOUND           The TLS session data is not found.
 219   @retval EFI_NOT_READY           The DataType is not ready in current session state.
 220   @retval EFI_BUFFER_TOO_SMALL    The buffer is too small to hold the data.
 221 **/
 222 EFI_STATUS
 223 EFIAPI
 224 TlsGetSessionData (
 225   IN     EFI_TLS_PROTOCOL              *This,
 226   IN     EFI_TLS_SESSION_DATA_TYPE     DataType,
 227   IN OUT VOID                          *Data,  OPTIONAL
 228   IN OUT UINTN                         *DataSize
 229   )
 230 {
 231   EFI_STATUS                Status;
 232   TLS_INSTANCE              *Instance;
 233
 234   EFI_TPL                   OldTpl;
 235
 236   Status = EFI_SUCCESS;
 237
 238   if (This == NULL || DataSize == NULL || (Data == NULL && *DataSize != 0)) {
 239     return EFI_INVALID_PARAMETER;
 240   }
 241
 242   OldTpl = gBS->RaiseTPL (TPL_CALLBACK);
 243
 244   Instance = TLS_INSTANCE_FROM_PROTOCOL (This);
 245
 246   if (Instance->TlsSessionState == EfiTlsSessionNotStarted &&
 247     (DataType == EfiTlsSessionID || DataType == EfiTlsClientRandom ||
 248     DataType == EfiTlsServerRandom || DataType == EfiTlsKeyMaterial)) {
 249     Status = EFI_NOT_READY;
 250     goto ON_EXIT;
 251   }
 252
 253   switch (DataType) {
 254   case EfiTlsVersion:
 255     if (*DataSize < sizeof (EFI_TLS_VERSION)) {
 256       *DataSize = sizeof (EFI_TLS_VERSION);
 257       Status = EFI_BUFFER_TOO_SMALL;
 258       goto ON_EXIT;
 259     }
 260     *DataSize = sizeof (EFI_TLS_VERSION);
 261     *((UINT16 *) Data) = HTONS (TlsGetVersion (Instance->TlsConn));
 262     break;
 263   case EfiTlsConnectionEnd:
 264     if (*DataSize < sizeof (EFI_TLS_CONNECTION_END)) {
 265       *DataSize = sizeof (EFI_TLS_CONNECTION_END);
 266       Status = EFI_BUFFER_TOO_SMALL;
 267       goto ON_EXIT;
 268     }
 269     *DataSize = sizeof (EFI_TLS_CONNECTION_END);
 270     *((UINT8 *) Data) = TlsGetConnectionEnd (Instance->TlsConn);
 271     break;
 272   case EfiTlsCipherList:
 273     //
 274     // Get the current session cipher suite.
 275     //
 276     if (*DataSize < sizeof (EFI_TLS_CIPHER)) {
 277       *DataSize = sizeof (EFI_TLS_CIPHER);
 278       Status = EFI_BUFFER_TOO_SMALL;
 279       goto ON_EXIT;
 280     }
 281     *DataSize = sizeof(EFI_TLS_CIPHER);
 282     Status = TlsGetCurrentCipher (Instance->TlsConn, (UINT16 *) Data);
 283     *((UINT16 *) Data) = HTONS (*((UINT16 *) Data));
 284     break;
 285   case EfiTlsCompressionMethod:
 286     //
 287     // Get the current session compression method.
 288     //
 289     if (*DataSize < sizeof (EFI_TLS_COMPRESSION)) {
 290       *DataSize = sizeof (EFI_TLS_COMPRESSION);
 291       Status = EFI_BUFFER_TOO_SMALL;
 292       goto ON_EXIT;
 293     }
 294     *DataSize = sizeof (EFI_TLS_COMPRESSION);
 295     Status = TlsGetCurrentCompressionId (Instance->TlsConn, (UINT8 *) Data);
 296     break;
 297   case EfiTlsExtensionData:
 298     Status = EFI_UNSUPPORTED;
 299     goto ON_EXIT;
 300   case EfiTlsVerifyMethod:
 301     if (*DataSize < sizeof (EFI_TLS_VERIFY)) {
 302       *DataSize = sizeof (EFI_TLS_VERIFY);
 303       Status = EFI_BUFFER_TOO_SMALL;
 304       goto ON_EXIT;
 305     }
 306     *DataSize = sizeof (EFI_TLS_VERIFY);
 307     *((UINT32 *) Data) = TlsGetVerify (Instance->TlsConn);
 308     break;
 309   case EfiTlsSessionID:
 310     if (*DataSize < sizeof (EFI_TLS_SESSION_ID)) {
 311       *DataSize = sizeof (EFI_TLS_SESSION_ID);
 312       Status = EFI_BUFFER_TOO_SMALL;
 313       goto ON_EXIT;
 314     }
 315     *DataSize = sizeof (EFI_TLS_SESSION_ID);
 316     Status = TlsGetSessionId (
 317                Instance->TlsConn,
 318                ((EFI_TLS_SESSION_ID *) Data)->Data,
 319                &(((EFI_TLS_SESSION_ID *) Data)->Length)
 320                );
 321     break;
 322   case EfiTlsSessionState:
 323     if (*DataSize < sizeof (EFI_TLS_SESSION_STATE)) {
 324       *DataSize = sizeof (EFI_TLS_SESSION_STATE);
 325       Status = EFI_BUFFER_TOO_SMALL;
 326       goto ON_EXIT;
 327     }
 328     *DataSize = sizeof (EFI_TLS_SESSION_STATE);
 329     CopyMem (Data, &Instance->TlsSessionState, *DataSize);
 330     break;
 331   case EfiTlsClientRandom:
 332     if (*DataSize < sizeof (EFI_TLS_RANDOM)) {
 333       *DataSize = sizeof (EFI_TLS_RANDOM);
 334       Status = EFI_BUFFER_TOO_SMALL;
 335       goto ON_EXIT;
 336     }
 337     *DataSize = sizeof (EFI_TLS_RANDOM);
 338     TlsGetClientRandom (Instance->TlsConn, (UINT8 *) Data);
 339     break;
 340   case EfiTlsServerRandom:
 341     if (*DataSize < sizeof (EFI_TLS_RANDOM)) {
 342       *DataSize = sizeof (EFI_TLS_RANDOM);
 343       Status = EFI_BUFFER_TOO_SMALL;
 344       goto ON_EXIT;
 345     }
 346     *DataSize = sizeof (EFI_TLS_RANDOM);
 347     TlsGetServerRandom (Instance->TlsConn, (UINT8 *) Data);
 348     break;
 349   case EfiTlsKeyMaterial:
 350     if (*DataSize < sizeof (EFI_TLS_MASTER_SECRET)) {
 351       *DataSize = sizeof (EFI_TLS_MASTER_SECRET);
 352       Status = EFI_BUFFER_TOO_SMALL;
 353       goto ON_EXIT;
 354     }
 355     *DataSize = sizeof (EFI_TLS_MASTER_SECRET);
 356     Status = TlsGetKeyMaterial (Instance->TlsConn, (UINT8 *) Data);
 357     break;
 358   //
 359   // Unsupported type.
 360   //
 361   default:
 362     Status = EFI_UNSUPPORTED;
 363   }
 364
 365 ON_EXIT:
 366   gBS->RestoreTPL (OldTpl);
 367   return Status;
 368 }
 369
 370 /**
 371   Build response packet according to TLS state machine. This function is only valid for
 372   alert, handshake and change_cipher_spec content type.
 373
 374   The BuildResponsePacket() function builds TLS response packet in response to the TLS
 375   request packet specified by RequestBuffer and RequestSize. If RequestBuffer is NULL and
 376   RequestSize is 0, and TLS session status is EfiTlsSessionNotStarted, the TLS session
 377   will be initiated and the response packet needs to be ClientHello. If RequestBuffer is
 378   NULL and RequestSize is 0, and TLS session status is EfiTlsSessionClosing, the TLS
 379   session will be closed and response packet needs to be CloseNotify. If RequestBuffer is
 380   NULL and RequestSize is 0, and TLS session status is EfiTlsSessionError, the TLS
 381   session has errors and the response packet needs to be Alert message based on error
 382   type.
 383
 384   @param[in]       This           Pointer to the EFI_TLS_PROTOCOL instance.
 385   @param[in]       RequestBuffer  Pointer to the most recently received TLS packet. NULL
 386                                   means TLS need initiate the TLS session and response
 387                                   packet need to be ClientHello.
 388   @param[in]       RequestSize    Packet size in bytes for the most recently received TLS
 389                                   packet. 0 is only valid when RequestBuffer is NULL.
 390   @param[out]      Buffer         Pointer to the buffer to hold the built packet.
 391   @param[in, out]  BufferSize     Pointer to the buffer size in bytes. On input, it is
 392                                   the buffer size provided by the caller. On output, it
 393                                   is the buffer size in fact needed to contain the
 394                                   packet.
 395
 396   @retval EFI_SUCCESS             The required TLS packet is built successfully.
 397   @retval EFI_INVALID_PARAMETER   One or more of the following conditions is TRUE:
 398                                   This is NULL.
 399                                   RequestBuffer is NULL but RequestSize is NOT 0.
 400                                   RequestSize is 0 but RequestBuffer is NOT NULL.
 401                                   BufferSize is NULL.
 402                                   Buffer is NULL if *BufferSize is not zero.
 403   @retval EFI_BUFFER_TOO_SMALL    BufferSize is too small to hold the response packet.
 404   @retval EFI_NOT_READY           Current TLS session state is NOT ready to build
 405                                   ResponsePacket.
 406   @retval EFI_ABORTED             Something wrong build response packet.
 407 **/
 408 EFI_STATUS
 409 EFIAPI
 410 TlsBuildResponsePacket (
 411   IN     EFI_TLS_PROTOCOL              *This,
 412   IN     UINT8                         *RequestBuffer, OPTIONAL
 413   IN     UINTN                         RequestSize, OPTIONAL
 414      OUT UINT8                         *Buffer, OPTIONAL
 415   IN OUT UINTN                         *BufferSize
 416   )
 417 {
 418   EFI_STATUS                Status;
 419   TLS_INSTANCE              *Instance;
 420   EFI_TPL                   OldTpl;
 421
 422   Status = EFI_SUCCESS;
 423
 424   if ((This == NULL) || (BufferSize == NULL) ||
 425       (RequestBuffer == NULL && RequestSize != 0) ||
 426       (RequestBuffer != NULL && RequestSize == 0) ||
 427       (Buffer == NULL && *BufferSize !=0)) {
 428     return EFI_INVALID_PARAMETER;
 429   }
 430
 431   OldTpl = gBS->RaiseTPL (TPL_CALLBACK);
 432
 433   Instance = TLS_INSTANCE_FROM_PROTOCOL (This);
 434
 435   if(RequestBuffer == NULL && RequestSize == 0) {
 436     switch (Instance->TlsSessionState) {
 437     case EfiTlsSessionNotStarted:
 438       //
 439       // ClientHello.
 440       //
 441       Status = TlsDoHandshake (
 442                  Instance->TlsConn,
 443                  NULL,
 444                  0,
 445                  Buffer,
 446                  BufferSize
 447                  );
 448       if (EFI_ERROR (Status)) {
 449         goto ON_EXIT;
 450       }
 451
 452       //
 453       // *BufferSize should not be zero when ClientHello.
 454       //
 455       if (*BufferSize == 0) {
 456         Status = EFI_ABORTED;
 457         goto ON_EXIT;
 458       }
 459
 460       Instance->TlsSessionState = EfiTlsSessionHandShaking;
 461
 462       break;
 463     case EfiTlsSessionClosing:
 464       //
 465       // TLS session will be closed and response packet needs to be CloseNotify.
 466       //
 467       Status = TlsCloseNotify (
 468                  Instance->TlsConn,
 469                  Buffer,
 470                  BufferSize
 471                  );
 472       if (EFI_ERROR (Status)) {
 473         goto ON_EXIT;
 474       }
 475
 476       //
 477       // *BufferSize should not be zero when build CloseNotify message.
 478       //
 479       if (*BufferSize == 0) {
 480         Status = EFI_ABORTED;
 481         goto ON_EXIT;
 482       }
 483
 484       break;
 485     case EfiTlsSessionError:
 486       //
 487       // TLS session has errors and the response packet needs to be Alert
 488       // message based on error type.
 489       //
 490       Status = TlsHandleAlert (
 491                  Instance->TlsConn,
 492                  NULL,
 493                  0,
 494                  Buffer,
 495                  BufferSize
 496                  );
 497       if (EFI_ERROR (Status)) {
 498         goto ON_EXIT;
 499       }
 500
 501       break;
 502     default:
 503       //
 504       // Current TLS session state is NOT ready to build ResponsePacket.
 505       //
 506       Status = EFI_NOT_READY;
 507     }
 508   } else {
 509     //
 510     // 1. Received packet may have multiple TLS record messages.
 511     // 2. One TLS record message may have multiple handshake protocol.
 512     // 3. Some errors may be happened in handshake.
 513     // TlsDoHandshake() can handle all of those cases.
 514     //
 515     if (TlsInHandshake (Instance->TlsConn)) {
 516       Status = TlsDoHandshake (
 517                  Instance->TlsConn,
 518                  RequestBuffer,
 519                  RequestSize,
 520                  Buffer,
 521                  BufferSize
 522                  );
 523       if (EFI_ERROR (Status)) {
 524         goto ON_EXIT;
 525       }
 526
 527       if (!TlsInHandshake (Instance->TlsConn)) {
 528         Instance->TlsSessionState = EfiTlsSessionDataTransferring;
 529       }
 530     } else {
 531       //
 532       // Must be alert message, Decrypt it and build the ResponsePacket.
 533       //
 534       ASSERT (((TLS_RECORD_HEADER *) RequestBuffer)->ContentType == TlsContentTypeAlert);
 535
 536       Status = TlsHandleAlert (
 537                  Instance->TlsConn,
 538                  RequestBuffer,
 539                  RequestSize,
 540                  Buffer,
 541                  BufferSize
 542                  );
 543       if (EFI_ERROR (Status)) {
 544         if (Status != EFI_BUFFER_TOO_SMALL) {
 545           Instance->TlsSessionState = EfiTlsSessionError;
 546         }
 547
 548         goto ON_EXIT;
 549       }
 550     }
 551   }
 552
 553 ON_EXIT:
 554   gBS->RestoreTPL (OldTpl);
 555   return Status;
 556 }
 557
 558 /**
 559   Decrypt or encrypt TLS packet during session. This function is only valid after
 560   session connected and for application_data content type.
 561
 562   The ProcessPacket () function process each inbound or outbound TLS APP packet.
 563
 564   @param[in]       This           Pointer to the EFI_TLS_PROTOCOL instance.
 565   @param[in, out]  FragmentTable  Pointer to a list of fragment. The caller will take
 566                                   responsible to handle the original FragmentTable while
 567                                   it may be reallocated in TLS driver. If CryptMode is
 568                                   EfiTlsEncrypt, on input these fragments contain the TLS
 569                                   header and plain text TLS APP payload; on output these
 570                                   fragments contain the TLS header and cipher text TLS
 571                                   APP payload. If CryptMode is EfiTlsDecrypt, on input
 572                                   these fragments contain the TLS header and cipher text
 573                                   TLS APP payload; on output these fragments contain the
 574                                   TLS header and plain text TLS APP payload.
 575   @param[in]       FragmentCount  Number of fragment.
 576   @param[in]       CryptMode      Crypt mode.
 577
 578   @retval EFI_SUCCESS             The operation completed successfully.
 579   @retval EFI_INVALID_PARAMETER   One or more of the following conditions is TRUE:
 580                                   This is NULL.
 581                                   FragmentTable is NULL.
 582                                   FragmentCount is NULL.
 583                                   CryptoMode is invalid.
 584   @retval EFI_NOT_READY           Current TLS session state is NOT
 585                                   EfiTlsSessionDataTransferring.
 586   @retval EFI_ABORTED             Something wrong decryption the message. TLS session
 587                                   status will become EfiTlsSessionError. The caller need
 588                                   call BuildResponsePacket() to generate Error Alert
 589                                   message and send it out.
 590   @retval EFI_OUT_OF_RESOURCES    No enough resource to finish the operation.
 591 **/
 592 EFI_STATUS
 593 EFIAPI
 594 TlsProcessPacket (
 595   IN     EFI_TLS_PROTOCOL              *This,
 596   IN OUT EFI_TLS_FRAGMENT_DATA         **FragmentTable,
 597   IN     UINT32                        *FragmentCount,
 598   IN     EFI_TLS_CRYPT_MODE            CryptMode
 599   )
 600 {
 601   EFI_STATUS                Status;
 602   TLS_INSTANCE              *Instance;
 603
 604   EFI_TPL                   OldTpl;
 605
 606   Status = EFI_SUCCESS;
 607
 608   if (This == NULL || FragmentTable == NULL || FragmentCount == NULL) {
 609     return EFI_INVALID_PARAMETER;
 610   }
 611
 612   OldTpl = gBS->RaiseTPL (TPL_CALLBACK);
 613
 614   Instance = TLS_INSTANCE_FROM_PROTOCOL (This);
 615
 616   if (Instance->TlsSessionState != EfiTlsSessionDataTransferring) {
 617     Status = EFI_NOT_READY;
 618     goto ON_EXIT;
 619   }
 620
 621   //
 622   // Packet sent or received may have multiple TLS record messages (Application data type).
 623   // So,on input these fragments contain the TLS header and TLS APP payload;
 624   // on output these fragments also contain the TLS header and TLS APP payload.
 625   //
 626   switch (CryptMode) {
 627   case EfiTlsEncrypt:
 628     Status = TlsEncryptPacket (Instance, FragmentTable, FragmentCount);
 629     break;
 630   case EfiTlsDecrypt:
 631     Status = TlsDecryptPacket (Instance, FragmentTable, FragmentCount);
 632     break;
 633   default:
 634     return EFI_INVALID_PARAMETER;
 635   }
 636
 637 ON_EXIT:
 638   gBS->RestoreTPL (OldTpl);
 639   return Status;
 640 }
 641