NetworkPkg/IpSecDxe: Fix UEFI IKE Initial Exchange failure

*v2: update the commit log.

IKE Initial Exchange message should cover below process:
           Initiator                    Responder
Message1 HDR,SAil,KEi,Ni  ------>
Message2                  <------   HDR,SArl,KEr,Nr,[CERTREQ]
Message3 HDR,SK{}         ------>
Message4                  <------   HDR,SK{}

If Initial Exchange message is initiated by Linux IKE, it works well.
But the failure will happen if it's initiated by UEFI IKE. This issue
is caused by the no status check of NotifyCookiePayload.

While parsing the IKEv2 packet for IKE_SA_INIT exchange, if the packet
doesn't contain COOKIE Notify payload, EFI_INVALID_PARAMETER will be
returned from Ikev2ParserNotifyCookiePayload(). Current implementation
return this error status directly, then the session will be broken. The
correct behavior should check this status. If no COOKIE Notify payload,
initiator don't need to retry the IKE_SA_INIT.

Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Cc: Zhang Lubo <lubo.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>

diff --git a/NetworkPkg/IpSecDxe/Ikev2/Sa.c b/NetworkPkg/IpSecDxe/Ikev2/Sa.c
index 4cbfac33b1344bc4def1540b30fc5f8bf57e1c9f..f9421ed4e804291c753eda1d2365dda7e80b80fc 100644 (file)
--- a/NetworkPkg/IpSecDxe/Ikev2/Sa.c
+++ b/NetworkPkg/IpSecDxe/Ikev2/Sa.c
@@ -287,9 +287,8 @@ Ikev2InitPskParser (
   // as first payload and all other payloads unchanged.\r
   //\r
   if (IkeSaSession->SessionCommon.IsInitiator) {\r
-    if (NotifyPayload != NULL) {\r
-      Status = Ikev2ParserNotifyCookiePayload (NotifyPayload, IkeSaSession);\r
-      return Status;\r
+    if (NotifyPayload != NULL && !EFI_ERROR(Ikev2ParserNotifyCookiePayload (NotifyPayload, IkeSaSession))) {\r
+      return EFI_SUCCESS;\r
     }\r
   }\r
 \r