+++ /dev/null
-/** @file\r
- Provide IPsec Key Exchange (IKE) service general interfaces.\r
-\r
- Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR>\r
-\r
- SPDX-License-Identifier: BSD-2-Clause-Patent\r
-\r
-**/\r
-\r
-#include "IkeService.h"\r
-#include "IpSecConfigImpl.h"\r
-\r
-IKE_EXCHANGE_INTERFACE *mIkeExchange[] = {\r
- &mIkev1Exchange,\r
- &mIkev2Exchange\r
-};\r
-\r
-EFI_UDP4_CONFIG_DATA mUdp4Conf = {\r
- FALSE,\r
- FALSE,\r
- FALSE,\r
- TRUE,\r
- //\r
- // IO parameters\r
- //\r
- 0,\r
- 64,\r
- FALSE,\r
- 0,\r
- 1000000,\r
- FALSE,\r
- {{0,0,0,0}},\r
- {{0,0,0,0}},\r
- IKE_DEFAULT_PORT,\r
- {{0,0,0,0}},\r
- 0\r
-};\r
-\r
-EFI_UDP6_CONFIG_DATA mUdp6Conf = {\r
- FALSE,\r
- FALSE,\r
- TRUE,\r
- //\r
- // IO parameters\r
- //\r
- 0,\r
- 128,\r
- 0,\r
- 1000000,\r
- //Access Point\r
- {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}},\r
- IKE_DEFAULT_PORT,\r
- {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}},\r
- 0\r
-};\r
-\r
-/**\r
- Check if the NIC handle is binded to a Udp service.\r
-\r
- @param[in] Private Pointer of IPSEC_PRIVATE_DATA.\r
- @param[in] Handle The Handle of the NIC card.\r
- @param[in] IpVersion The version of the IP stack.\r
-\r
- @return a pointer of IKE_UDP_SERVICE.\r
-\r
-**/\r
-IKE_UDP_SERVICE *\r
-IkeLookupUdp (\r
- IN IPSEC_PRIVATE_DATA *Private,\r
- IN EFI_HANDLE Handle,\r
- IN UINT8 IpVersion\r
- )\r
-{\r
- LIST_ENTRY *Head;\r
- LIST_ENTRY *Entry;\r
- LIST_ENTRY *Next;\r
- IKE_UDP_SERVICE *Udp;\r
-\r
- Udp = NULL;\r
- Head = (IpVersion == IP_VERSION_4) ? &Private->Udp4List : &Private->Udp6List;\r
-\r
- NET_LIST_FOR_EACH_SAFE (Entry, Next, Head) {\r
-\r
- Udp = IPSEC_UDP_SERVICE_FROM_LIST (Entry);\r
- //\r
- // Find the right udp service which installed on the appointed NIC handle.\r
- //\r
- if (Handle == Udp->NicHandle) {\r
- break;\r
- } else {\r
- Udp = NULL;\r
- }\r
- }\r
-\r
- return Udp;\r
-}\r
-\r
-/**\r
- Configure a UDPIO's UDP4 instance.\r
-\r
- This fuction is called by the UdpIoCreateIo() to configures a\r
- UDP4 instance.\r
-\r
- @param[in] UdpIo The UDP_IO to be configured.\r
- @param[in] Context User-defined data when calling UdpIoCreateIo().\r
-\r
- @retval EFI_SUCCESS The configuration succeeded.\r
- @retval Others The UDP4 instance fails to configure.\r
-\r
-**/\r
-EFI_STATUS\r
-EFIAPI\r
-IkeConfigUdp4 (\r
- IN UDP_IO *UdpIo,\r
- IN VOID *Context\r
- )\r
-{\r
- EFI_UDP4_CONFIG_DATA Udp4Cfg;\r
- EFI_UDP4_PROTOCOL *Udp4;\r
-\r
- ZeroMem (&Udp4Cfg, sizeof (EFI_UDP4_CONFIG_DATA));\r
-\r
- Udp4 = UdpIo->Protocol.Udp4;\r
- CopyMem (\r
- &Udp4Cfg,\r
- &mUdp4Conf,\r
- sizeof (EFI_UDP4_CONFIG_DATA)\r
- );\r
-\r
- if (Context != NULL) {\r
- //\r
- // Configure udp4 io with local default address.\r
- //\r
- Udp4Cfg.UseDefaultAddress = TRUE;\r
- }\r
-\r
- return Udp4->Configure (Udp4, &Udp4Cfg);\r
-}\r
-\r
-/**\r
- Configure a UDPIO's UDP6 instance.\r
-\r
- This fuction is called by the UdpIoCreateIo()to configure a\r
- UDP6 instance.\r
-\r
- @param[in] UdpIo The UDP_IO to be configured.\r
- @param[in] Context User-defined data when calling UdpIoCreateIo().\r
-\r
- @retval EFI_SUCCESS The configuration succeeded.\r
- @retval Others The configuration fails.\r
-\r
-**/\r
-EFI_STATUS\r
-EFIAPI\r
-IkeConfigUdp6 (\r
- IN UDP_IO *UdpIo,\r
- IN VOID *Context\r
- )\r
-{\r
- EFI_UDP6_PROTOCOL *Udp6;\r
- EFI_UDP6_CONFIG_DATA Udp6Cfg;\r
-\r
- ZeroMem (&Udp6Cfg, sizeof (EFI_UDP6_CONFIG_DATA));\r
-\r
- Udp6 = UdpIo->Protocol.Udp6;\r
- CopyMem (\r
- &Udp6Cfg,\r
- &mUdp6Conf,\r
- sizeof (EFI_UDP6_CONFIG_DATA)\r
- );\r
-\r
- if (Context != NULL) {\r
- //\r
- // Configure instance with a destination address to start source address\r
- // selection, and then get the configure data from the mode data to store\r
- // the source address.\r
- //\r
- CopyMem (\r
- &Udp6Cfg.RemoteAddress,\r
- Context,\r
- sizeof (EFI_IPv6_ADDRESS)\r
- );\r
- }\r
-\r
- return Udp6->Configure (Udp6, &Udp6Cfg);\r
-}\r
-\r
-/**\r
- Open and configure the related output UDPIO for IKE packet sending.\r
-\r
- If the UdpService is not configured, this fuction calls UdpIoCreatIo() to\r
- create UDPIO to bind this UdpService for IKE packet sending. If the UdpService\r
- has already been configured, then return.\r
-\r
- @param[in] UdpService The UDP_IO to be configured.\r
- @param[in] RemoteIp User-defined data when calling UdpIoCreateIo().\r
-\r
- @retval EFI_SUCCESS The configuration is successful.\r
- @retval Others The configuration fails.\r
-\r
-**/\r
-EFI_STATUS\r
-IkeOpenOutputUdp (\r
- IN IKE_UDP_SERVICE *UdpService,\r
- IN EFI_IP_ADDRESS *RemoteIp\r
- )\r
-{\r
- EFI_STATUS Status;\r
- EFI_IP4_CONFIG2_PROTOCOL *Ip4Cfg2;\r
- EFI_IP4_CONFIG2_INTERFACE_INFO *IfInfo;\r
- UINTN BufSize;\r
- EFI_IP6_MODE_DATA Ip6ModeData;\r
- EFI_UDP6_PROTOCOL *Udp6;\r
-\r
- Status = EFI_SUCCESS;\r
- IfInfo = NULL;\r
- BufSize = 0;\r
-\r
- //\r
- // Check whether the input and output udp io are both configured.\r
- //\r
- if (UdpService->IsConfigured) {\r
- goto ON_EXIT;\r
- }\r
-\r
- if (UdpService->IpVersion == UDP_IO_UDP4_VERSION) {\r
- //\r
- // Handle ip4config protocol to get local default address.\r
- //\r
- Status = gBS->HandleProtocol (\r
- UdpService->NicHandle,\r
- &gEfiIp4Config2ProtocolGuid,\r
- (VOID **) &Ip4Cfg2\r
- );\r
-\r
- if (EFI_ERROR (Status)) {\r
- goto ON_EXIT;\r
- }\r
-\r
- //\r
- // Get the interface information size.\r
- //\r
- Status = Ip4Cfg2->GetData (\r
- Ip4Cfg2,\r
- Ip4Config2DataTypeInterfaceInfo,\r
- &BufSize,\r
- NULL\r
- );\r
-\r
- if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {\r
- goto ON_EXIT;\r
- }\r
-\r
- IfInfo = AllocateZeroPool (BufSize);\r
-\r
- if (IfInfo == NULL) {\r
- Status = EFI_OUT_OF_RESOURCES;\r
- goto ON_EXIT;\r
- }\r
-\r
- //\r
- // Get the interface info.\r
- //\r
- Status = Ip4Cfg2->GetData (\r
- Ip4Cfg2,\r
- Ip4Config2DataTypeInterfaceInfo,\r
- &BufSize,\r
- IfInfo\r
- );\r
-\r
- if (EFI_ERROR (Status)) {\r
- goto ON_EXIT;\r
- }\r
-\r
- CopyMem (\r
- &UdpService->DefaultAddress.v4,\r
- &IfInfo->StationAddress,\r
- sizeof (EFI_IPv4_ADDRESS)\r
- );\r
-\r
- //\r
- // Create udp4 io for output with local default address.\r
- //\r
- UdpService->Output = UdpIoCreateIo (\r
- UdpService->NicHandle,\r
- UdpService->ImageHandle,\r
- IkeConfigUdp4,\r
- UDP_IO_UDP4_VERSION,\r
- &UdpService->DefaultAddress\r
- );\r
-\r
- if (UdpService->Output == NULL) {\r
- Status = EFI_OUT_OF_RESOURCES;\r
- goto ON_EXIT;\r
- }\r
-\r
- } else {\r
- //\r
- // Create udp6 io for output with remote address.\r
- //\r
- UdpService->Output = UdpIoCreateIo (\r
- UdpService->NicHandle,\r
- UdpService->ImageHandle,\r
- IkeConfigUdp6,\r
- UDP_IO_UDP6_VERSION,\r
- RemoteIp\r
- );\r
-\r
- if (UdpService->Output == NULL) {\r
- Status = EFI_OUT_OF_RESOURCES;\r
- goto ON_EXIT;\r
- }\r
- //\r
- // Get ip6 mode data to get the result of source address selection.\r
- //\r
- ZeroMem (&Ip6ModeData, sizeof (EFI_IP6_MODE_DATA));\r
-\r
- Udp6 = UdpService->Output->Protocol.Udp6;\r
- Status = Udp6->GetModeData (Udp6, NULL, &Ip6ModeData, NULL, NULL);\r
-\r
- if (EFI_ERROR (Status)) {\r
- UdpIoFreeIo (UdpService->Output);\r
- goto ON_EXIT;\r
- }\r
-\r
- if (Ip6ModeData.AddressList != NULL) {\r
- FreePool (Ip6ModeData.AddressList);\r
- }\r
-\r
- if (Ip6ModeData.GroupTable != NULL) {\r
- FreePool (Ip6ModeData.GroupTable);\r
- }\r
-\r
- if (Ip6ModeData.RouteTable != NULL) {\r
- FreePool (Ip6ModeData.RouteTable);\r
- }\r
-\r
- if (Ip6ModeData.NeighborCache != NULL) {\r
- FreePool (Ip6ModeData.NeighborCache);\r
- }\r
-\r
- if (Ip6ModeData.PrefixTable != NULL) {\r
- FreePool (Ip6ModeData.PrefixTable);\r
- }\r
-\r
- if (Ip6ModeData.IcmpTypeList != NULL) {\r
- FreePool (Ip6ModeData.IcmpTypeList);\r
- }\r
-\r
- //\r
- // Reconfigure udp6 io without remote address.\r
- //\r
- Udp6->Configure (Udp6, NULL);\r
- Status = IkeConfigUdp6 (UdpService->Output, NULL);\r
-\r
- //\r
- // Record the selected source address for ipsec process later.\r
- //\r
- CopyMem (\r
- &UdpService->DefaultAddress.v6,\r
- &Ip6ModeData.ConfigData.StationAddress,\r
- sizeof (EFI_IPv6_ADDRESS)\r
- );\r
- }\r
-\r
- UdpService->IsConfigured = TRUE;\r
-\r
-ON_EXIT:\r
- if (IfInfo != NULL) {\r
- FreePool (IfInfo);\r
- }\r
-\r
- return Status;\r
-}\r
-\r
-/**\r
- Open and configure a UDPIO of Udp4 for IKE packet receiving.\r
-\r
- This function is called at the IPsecDriverBinding start. IPsec create a UDP4 and\r
- UDP4 IO for each NIC handle.\r
-\r
- @param[in] Private Point to IPSEC_PRIVATE_DATA\r
- @param[in] Controller Handler for NIC card.\r
- @param[in] ImageHandle The handle that contains the EFI_DRIVER_BINDING_PROTOCOL instance.\r
-\r
- @retval EFI_SUCCESS The Operation is successful.\r
- @retval EFI_OUT_OF_RESOURCE The required system resource can't be allocated.\r
-\r
-**/\r
-EFI_STATUS\r
-IkeOpenInputUdp4 (\r
- IN IPSEC_PRIVATE_DATA *Private,\r
- IN EFI_HANDLE Controller,\r
- IN EFI_HANDLE ImageHandle\r
- )\r
-{\r
- IKE_UDP_SERVICE *Udp4Srv;\r
-\r
- //\r
- // Check whether udp4 io of the controller has already been opened.\r
- //\r
- Udp4Srv = IkeLookupUdp (Private, Controller, IP_VERSION_4);\r
-\r
- if (Udp4Srv != NULL) {\r
- return EFI_ALREADY_STARTED;\r
- }\r
-\r
- Udp4Srv = AllocateZeroPool (sizeof (IKE_UDP_SERVICE));\r
-\r
- if (Udp4Srv == NULL) {\r
- return EFI_OUT_OF_RESOURCES;\r
- }\r
- //\r
- // Create udp4 io for iutput.\r
- //\r
- Udp4Srv->Input = UdpIoCreateIo (\r
- Controller,\r
- ImageHandle,\r
- IkeConfigUdp4,\r
- UDP_IO_UDP4_VERSION,\r
- NULL\r
- );\r
-\r
- if (Udp4Srv->Input == NULL) {\r
- FreePool (Udp4Srv);\r
- return EFI_OUT_OF_RESOURCES;\r
- }\r
-\r
- Udp4Srv->NicHandle = Controller;\r
- Udp4Srv->ImageHandle = ImageHandle;\r
- Udp4Srv->ListHead = &(Private->Udp4List);\r
- Udp4Srv->IpVersion = UDP_IO_UDP4_VERSION;\r
- Udp4Srv->IsConfigured = FALSE;\r
-\r
- ZeroMem (&Udp4Srv->DefaultAddress, sizeof (EFI_IP_ADDRESS));\r
-\r
- //\r
- // Insert the udp4 io into the list and increase the count.\r
- //\r
- InsertTailList (&Private->Udp4List, &Udp4Srv->List);\r
-\r
- Private->Udp4Num++;\r
-\r
- UdpIoRecvDatagram (Udp4Srv->Input, IkeDispatch, Udp4Srv, 0);\r
-\r
- return EFI_SUCCESS;\r
-}\r
-\r
-/**\r
- Open and configure a UDPIO of Udp6 for IKE packet receiving.\r
-\r
- This function is called at the IPsecDriverBinding start. IPsec create a UDP6 and UDP6\r
- IO for each NIC handle.\r
-\r
- @param[in] Private Point to IPSEC_PRIVATE_DATA\r
- @param[in] Controller Handler for NIC card.\r
- @param[in] ImageHandle The handle that contains the EFI_DRIVER_BINDING_PROTOCOL instance.\r
-\r
- @retval EFI_SUCCESS The Operation is successful.\r
- @retval EFI_OUT_OF_RESOURCE The required system resource can't be allocated.\r
-\r
-**/\r
-EFI_STATUS\r
-IkeOpenInputUdp6 (\r
- IN IPSEC_PRIVATE_DATA *Private,\r
- IN EFI_HANDLE Controller,\r
- IN EFI_HANDLE ImageHandle\r
- )\r
-{\r
- IKE_UDP_SERVICE *Udp6Srv;\r
-\r
- Udp6Srv = IkeLookupUdp (Private, Controller, IP_VERSION_6);\r
-\r
- if (Udp6Srv != NULL) {\r
- return EFI_ALREADY_STARTED;\r
- }\r
-\r
- Udp6Srv = AllocateZeroPool (sizeof (IKE_UDP_SERVICE));\r
-\r
- if (Udp6Srv == NULL) {\r
- return EFI_OUT_OF_RESOURCES;\r
- }\r
- //\r
- // Create udp6 io for input.\r
- //\r
- Udp6Srv->Input = UdpIoCreateIo (\r
- Controller,\r
- ImageHandle,\r
- IkeConfigUdp6,\r
- UDP_IO_UDP6_VERSION,\r
- NULL\r
- );\r
-\r
- if (Udp6Srv->Input == NULL) {\r
- FreePool (Udp6Srv);\r
- return EFI_OUT_OF_RESOURCES;\r
- }\r
-\r
- Udp6Srv->NicHandle = Controller;\r
- Udp6Srv->ImageHandle = ImageHandle;\r
- Udp6Srv->ListHead = &(Private->Udp6List);\r
- Udp6Srv->IpVersion = UDP_IO_UDP6_VERSION;\r
- Udp6Srv->IsConfigured = FALSE;\r
-\r
- ZeroMem (&Udp6Srv->DefaultAddress, sizeof (EFI_IP_ADDRESS));\r
-\r
- //\r
- // Insert the udp6 io into the list and increase the count.\r
- //\r
- InsertTailList (&Private->Udp6List, &Udp6Srv->List);\r
-\r
- Private->Udp6Num++;\r
-\r
- UdpIoRecvDatagram (Udp6Srv->Input, IkeDispatch, Udp6Srv, 0);\r
-\r
- return EFI_SUCCESS;\r
-}\r
-\r
-/**\r
- The general interface of starting IPsec Key Exchange.\r
-\r
- This function is called when a IKE negotiation to start getting a Key.\r
-\r
- @param[in] UdpService Point to IKE_UDP_SERVICE which will be used for\r
- IKE packet sending.\r
- @param[in] SpdEntry Point to the SPD entry related to the IKE negotiation.\r
- @param[in] RemoteIp Point to EFI_IP_ADDRESS related to the IKE negotiation.\r
-\r
- @retval EFI_SUCCESS The Operation is successful.\r
- @retval EFI_ACCESS_DENIED No related PAD entry was found.\r
- @retval EFI_INVALID_PARAMETER The IKE version is not supported.\r
-\r
-**/\r
-EFI_STATUS\r
-IkeNegotiate (\r
- IN IKE_UDP_SERVICE *UdpService,\r
- IN IPSEC_SPD_ENTRY *SpdEntry,\r
- IN EFI_IP_ADDRESS *RemoteIp\r
- )\r
-{\r
- EFI_STATUS Status;\r
- UINT8 *IkeSaSession;\r
- IKE_EXCHANGE_INTERFACE *Exchange;\r
- IPSEC_PRIVATE_DATA *Private;\r
- IPSEC_PAD_ENTRY *PadEntry;\r
- UINT8 IkeVersion;\r
-\r
- Private = (UdpService->IpVersion == IP_VERSION_4) ?\r
- IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :\r
- IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);\r
-\r
- //\r
- // Try to open udp io for output if it hasn't.\r
- //\r
- Status = IkeOpenOutputUdp (UdpService, RemoteIp);\r
- if (EFI_ERROR (Status)) {\r
- return Status;\r
- }\r
- //\r
- // Try to find the IKE SA session in the IKEv1 and IKEv2 established SA session list.\r
- //\r
- IkeSaSession = (UINT8 *) Ikev2SaSessionLookup (&Private->Ikev2EstablishedList, RemoteIp);\r
-\r
-\r
- if (IkeSaSession == NULL) {\r
- //\r
- // Find the pad entry by the remote ip address.\r
- //\r
- PadEntry = IpSecLookupPadEntry (UdpService->IpVersion, RemoteIp);\r
- if (PadEntry == NULL) {\r
- return EFI_ACCESS_DENIED;\r
- }\r
- //\r
- // Determine the IKE exchange instance by the auth protocol in pad entry.\r
- //\r
- ASSERT (PadEntry->Data->AuthProtocol < EfiIPsecAuthProtocolMaximum);\r
- if (PadEntry->Data->AuthProtocol == EfiIPsecAuthProtocolIKEv1) {\r
- return EFI_INVALID_PARAMETER;\r
- }\r
- Exchange = mIkeExchange[PadEntry->Data->AuthProtocol];\r
- //\r
- // Start the main mode stage to negotiate IKE SA.\r
- //\r
- Status = Exchange->NegotiateSa (UdpService, SpdEntry, PadEntry, RemoteIp);\r
- } else {\r
- //\r
- // Determine the IKE exchange instance by the IKE version in IKE SA session.\r
- //\r
- IkeVersion = IkeGetVersionFromSession (IkeSaSession);\r
- if (IkeVersion != 2) {\r
- return EFI_INVALID_PARAMETER;\r
- }\r
-\r
- Exchange = mIkeExchange[IkeVersion - 1];\r
- //\r
- // Start the quick mode stage to negotiate child SA.\r
- //\r
- Status = Exchange->NegotiateChildSa (IkeSaSession, SpdEntry, NULL);\r
- }\r
-\r
- return Status;\r
-}\r
-\r
-/**\r
- The generic interface when receive a IKE packet.\r
-\r
- This function is called when UDP IO receives a IKE packet.\r
-\r
- @param[in] Packet Point to received IKE packet.\r
- @param[in] EndPoint Point to UDP_END_POINT which contains the information of\r
- Remote IP and Port.\r
- @param[in] IoStatus The Status of Recieve Token.\r
- @param[in] Context Point to data passed from the caller.\r
-\r
-**/\r
-VOID\r
-EFIAPI\r
-IkeDispatch (\r
- IN NET_BUF *Packet,\r
- IN UDP_END_POINT *EndPoint,\r
- IN EFI_STATUS IoStatus,\r
- IN VOID *Context\r
- )\r
-{\r
- IPSEC_PRIVATE_DATA *Private;\r
- IKE_PACKET *IkePacket;\r
- IKE_HEADER *IkeHdr;\r
- IKE_UDP_SERVICE *UdpService;\r
- IKE_EXCHANGE_INTERFACE *Exchange;\r
- EFI_STATUS Status;\r
-\r
- UdpService = (IKE_UDP_SERVICE *) Context;\r
- IkePacket = NULL;\r
- Private = (UdpService->IpVersion == IP_VERSION_4) ?\r
- IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :\r
- IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);\r
-\r
- if (EFI_ERROR (IoStatus)) {\r
- goto ON_EXIT;\r
- }\r
- //\r
- // Check whether the ipsec is enabled or not.\r
- //\r
- if (Private->IpSec.DisabledFlag == TRUE) {\r
- goto ON_EXIT;\r
- }\r
-\r
- if (EndPoint->RemotePort != IKE_DEFAULT_PORT) {\r
- goto ON_EXIT;\r
- }\r
-\r
- //\r
- // Build IKE packet from the received netbuf.\r
- //\r
- IkePacket = IkePacketFromNetbuf (Packet);\r
-\r
- if (IkePacket == NULL) {\r
- goto ON_EXIT;\r
- }\r
- //\r
- // Get the remote address from the IKE packet.\r
- //\r
- if (UdpService->IpVersion == IP_VERSION_4) {\r
- *(UINT32 *) IkePacket->RemotePeerIp.Addr = HTONL ((*(UINT32 *) EndPoint->RemoteAddr.Addr));\r
- } else {\r
- CopyMem (\r
- &IkePacket->RemotePeerIp,\r
- NTOHLLL (&EndPoint->RemoteAddr.v6),\r
- sizeof (EFI_IPv6_ADDRESS)\r
- );\r
- }\r
- //\r
- // Try to open udp io for output if hasn't.\r
- //\r
- Status = IkeOpenOutputUdp (UdpService, &IkePacket->RemotePeerIp);\r
-\r
- if (EFI_ERROR (Status)) {\r
- goto ON_EXIT;\r
- }\r
-\r
- IkeHdr = IkePacket->Header;\r
-\r
- //\r
- // Determine the IKE exchange instance by the IKE version in IKE header.\r
- //\r
- if (IKE_MAJOR_VERSION (IkeHdr->Version) == 2) {\r
- Exchange = mIkeExchange[IKE_MAJOR_VERSION (IkeHdr->Version) - 1];\r
- } else {\r
- goto ON_EXIT;\r
- }\r
-\r
- switch (IkeHdr->ExchangeType) {\r
- case IKE_XCG_TYPE_IDENTITY_PROTECT:\r
- case IKE_XCG_TYPE_SA_INIT:\r
- case IKE_XCG_TYPE_AUTH:\r
- Exchange->HandleSa (UdpService, IkePacket);\r
- break;\r
-\r
- case IKE_XCG_TYPE_QM:\r
- case IKE_XCG_TYPE_CREATE_CHILD_SA:\r
- Exchange->HandleChildSa (UdpService, IkePacket);\r
- break;\r
-\r
- case IKE_XCG_TYPE_INFO:\r
- case IKE_XCG_TYPE_INFO2:\r
- Exchange->HandleInfo (UdpService, IkePacket);\r
- break;\r
-\r
- default:\r
- break;\r
- }\r
-\r
-ON_EXIT:\r
- if (IkePacket != NULL) {\r
- IkePacketFree (IkePacket);\r
- }\r
-\r
- if (Packet != NULL) {\r
- NetbufFree (Packet);\r
- }\r
-\r
- UdpIoRecvDatagram (UdpService->Input, IkeDispatch, UdpService, 0);\r
-\r
- return ;\r
-}\r
-\r
-/**\r
- Delete all established IKE SAs and related Child SAs.\r
-\r
- This function is the subfunction of the IpSecCleanupAllSa(). It first calls\r
- IkeDeleteChildSa() to delete all Child SAs then send out the related\r
- Information packet.\r
-\r
- @param[in] Private Pointer of the IPSEC_PRIVATE_DATA\r
- @param[in] IsDisableIpsec Indicate whether needs to disable IPsec.\r
-\r
-**/\r
-VOID\r
-IkeDeleteAllSas (\r
- IN IPSEC_PRIVATE_DATA *Private,\r
- IN BOOLEAN IsDisableIpsec\r
- )\r
-{\r
- LIST_ENTRY *Entry;\r
- LIST_ENTRY *NextEntry;\r
- IKEV2_SA_SESSION *Ikev2SaSession;\r
- UINT8 Value;\r
- EFI_STATUS Status;\r
- IKE_EXCHANGE_INTERFACE *Exchange;\r
- UINT8 IkeVersion;\r
-\r
- Exchange = NULL;\r
-\r
- //\r
- // If the IKEv1 is supported, first deal with the Ikev1Estatblished list.\r
- //\r
-\r
- //\r
- // If IKEv2 SAs are under establishing, delete it directly.\r
- //\r
- if (!IsListEmpty (&Private->Ikev2SessionList)) {\r
- NET_LIST_FOR_EACH_SAFE (Entry, NextEntry, &Private->Ikev2SessionList) {\r
- Ikev2SaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);\r
- RemoveEntryList (Entry);\r
- Ikev2SaSessionFree (Ikev2SaSession);\r
- }\r
- }\r
-\r
- //\r
- // If there is no existing established IKE SA, set the Ipsec DisableFlag to TRUE\r
- // and turn off the IsIPsecDisabling flag.\r
- //\r
- if (IsListEmpty (&Private->Ikev2EstablishedList) && IsDisableIpsec) {\r
- Value = IPSEC_STATUS_DISABLED;\r
- Status = gRT->SetVariable (\r
- IPSECCONFIG_STATUS_NAME,\r
- &gEfiIpSecConfigProtocolGuid,\r
- EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_NON_VOLATILE,\r
- sizeof (Value),\r
- &Value\r
- );\r
- if (!EFI_ERROR (Status)) {\r
- Private->IpSec.DisabledFlag = TRUE;\r
- Private->IsIPsecDisabling = FALSE;\r
- return ;\r
- }\r
- }\r
-\r
- //\r
- // Delete established IKEv2 SAs.\r
- //\r
- if (!IsListEmpty (&Private->Ikev2EstablishedList)) {\r
- for (Entry = Private->Ikev2EstablishedList.ForwardLink; Entry != &Private->Ikev2EstablishedList;) {\r
- Ikev2SaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);\r
- Entry = Entry->ForwardLink;\r
-\r
- Ikev2SaSession->SessionCommon.State = IkeStateSaDeleting;\r
-\r
- //\r
- // Call for Information Exchange.\r
- //\r
- IkeVersion = IkeGetVersionFromSession ((UINT8*)Ikev2SaSession);\r
- if (IkeVersion == 2) {\r
- Exchange = mIkeExchange[IkeVersion - 1];\r
- Exchange->NegotiateInfo((UINT8*)Ikev2SaSession, NULL);\r
- }\r
- }\r
- }\r
-\r
-}\r
-\r
-\r
-\r
projects / mirror_edk2.git / blobdiff