Before decrypting the packet, Ipsec will check if the inbound protected packet is...

Signed-off-by: qianouyang
Reviewed-by: zhangchaointel jyao1
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@12464 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/NetworkPkg/IpSecDxe/IpSecImpl.c b/NetworkPkg/IpSecDxe/IpSecImpl.c
index fe3a604ee4b5987e9bdf8f51917b2b31b05e97ff..47372578097a4836b1f8a96d958a48047b33d53b 100644 (file)
--- a/NetworkPkg/IpSecDxe/IpSecImpl.c
+++ b/NetworkPkg/IpSecDxe/IpSecImpl.c
@@ -783,7 +783,7 @@ IpSecEspAuthVerifyPayload (
   IN UINT8                           *EspBuffer,\r
   IN UINTN                           EspSize,\r
   IN IPSEC_SAD_ENTRY                 *SadEntry,\r
-  IN UINTN                           *IcvSize\r
+  IN UINTN                           IcvSize\r
   )\r
 {\r
   EFI_STATUS           Status;\r
@@ -794,8 +794,7 @@ IpSecEspAuthVerifyPayload (
   //\r
   // Calculate the size of authentication payload.\r
   //\r
-  *IcvSize  = IpSecGetIcvLength (SadEntry->Data->AlgoInfo.EspAlgoInfo.AuthAlgoId);\r
-  AuthSize  = EspSize - *IcvSize;\r
+  AuthSize  = EspSize - IcvSize;\r
 \r
   //\r
   // Calculate the icv buffer and size of the payload.\r
@@ -810,7 +809,7 @@ IpSecEspAuthVerifyPayload (
              HashFragment,\r
              1,\r
              IcvBuffer,\r
-             *IcvSize\r
+             IcvSize\r
              );\r
   if (EFI_ERROR (Status)) {\r
     return Status;\r
@@ -819,7 +818,7 @@ IpSecEspAuthVerifyPayload (
   //\r
   // Compare the calculated icv and the appended original icv.\r
   //\r
-  if (CompareMem (EspBuffer + AuthSize, IcvBuffer, *IcvSize) == 0) {\r
+  if (CompareMem (EspBuffer + AuthSize, IcvBuffer, IcvSize) == 0) {\r
     return EFI_SUCCESS;\r
   }\r
 \r
@@ -1371,7 +1370,7 @@ IpSecTunnelOutboundPacket (
 \r
   @retval EFI_SUCCESS              The operation was successful.\r
   @retval EFI_ACCESS_DENIED        One or more following conditions is TRUE:\r
-                                   - ESP header was not found.\r
+                                   - ESP header was not found or mal-format.\r
                                    - The related SAD entry was not found.\r
                                    - The related SAD entry does not support the ESP protocol.\r
   @retval EFI_OUT_OF_RESOURCES     The required system resource can't be allocated.\r
@@ -1394,6 +1393,8 @@ IpSecEspInboundPacket (
   NET_BUF               *Payload;\r
   UINTN                 EspSize;\r
   UINTN                 IvSize;\r
+  UINTN                 BlockSize;\r
+  UINTN                 MiscSize;\r
   UINTN                 PlainPayloadSize;\r
   UINTN                 PaddingSize;\r
   UINTN                 IcvSize;\r
@@ -1486,15 +1487,36 @@ IpSecEspInboundPacket (
   NetbufCopy (Payload, 0, (UINT32) EspSize, ProcessBuffer);\r
 \r
   //\r
-  // Authenticate the esp wrapped buffer by the auth keys which is from SAD entry.\r
+  // Get the IcvSize for authentication and BlockSize/IvSize for Decryption.\r
+  //\r
+  IcvSize   = IpSecGetIcvLength (SadEntry->Data->AlgoInfo.EspAlgoInfo.AuthAlgoId);\r
+  IvSize    = IpSecGetEncryptIvLength (SadEntry->Data->AlgoInfo.EspAlgoInfo.EncAlgoId);\r
+  BlockSize = IpSecGetEncryptBlockSize (SadEntry->Data->AlgoInfo.EspAlgoInfo.EncAlgoId);\r
+  \r
+  //\r
+  // Make sure the ESP packet is not mal-formt.\r
+  // 1. Check whether the Espsize is larger than ESP header + IvSize + EspTail + IcvSize.\r
+  // 2. Check whether the left payload size is multiple of IvSize.\r
+  //\r
+  MiscSize = sizeof (EFI_ESP_HEADER) + IvSize + IcvSize;\r
+  if (EspSize <= (MiscSize + sizeof (EFI_ESP_TAIL))) {\r
+    Status = EFI_ACCESS_DENIED;\r
+    goto ON_EXIT;\r
+  }\r
+  if ((EspSize - MiscSize) % BlockSize != 0) {\r
+    Status = EFI_ACCESS_DENIED;\r
+    goto ON_EXIT;\r
+  }\r
+\r
+  //\r
+  // Authenticate the ESP packet.\r
   //\r
-  IcvSize = 0;\r
   if (SadData->AlgoInfo.EspAlgoInfo.AuthKey != NULL) {\r
     Status = IpSecEspAuthVerifyPayload (\r
                ProcessBuffer,\r
                EspSize,\r
                SadEntry,\r
-               &IcvSize\r
+               IcvSize\r
                );\r
     if (EFI_ERROR (Status)) {\r
       goto ON_EXIT;\r
@@ -1503,7 +1525,6 @@ IpSecEspInboundPacket (
   //\r
   // Decrypt the payload by the SAD entry if it has decrypt key.\r
   //\r
-  IvSize = IpSecGetEncryptIvLength (SadEntry->Data->AlgoInfo.EspAlgoInfo.EncAlgoId);\r
   if (SadData->AlgoInfo.EspAlgoInfo.EncKey != NULL) {\r
     Status = IpSecCryptoIoDecrypt (\r
                SadEntry->Data->AlgoInfo.EspAlgoInfo.EncAlgoId,\r
@@ -1525,7 +1546,12 @@ IpSecEspInboundPacket (
   EspTail           = (EFI_ESP_TAIL *) (ProcessBuffer + EspSize - IcvSize - sizeof (EFI_ESP_TAIL));\r
   PaddingSize       = EspTail->PaddingLength;\r
   NextHeader        = EspTail->NextHeader;\r
-  PlainPayloadSize  = EspSize - sizeof (EFI_ESP_HEADER) - IvSize - IcvSize - sizeof (EFI_ESP_TAIL) - PaddingSize;\r
+  \r
+  if (EspSize <= (MiscSize + sizeof (EFI_ESP_TAIL) + PaddingSize)) {\r
+    Status = EFI_ACCESS_DENIED;\r
+    goto ON_EXIT;\r
+  }\r
+  PlainPayloadSize  = EspSize - MiscSize - sizeof (EFI_ESP_TAIL) - PaddingSize;\r
   \r
   //\r
   // TODO: handle anti-replay window\r