1. In IPv4 and IPv6 driver, before calling IPsec, a new NET_FRAGMENT structure is...

2. In IPsec driver it wrongly use the HeadLen to calculate the IP header length after the IPsec process. Correct this mistake.

Signed-off-by: qianouyang
Reviewed-by: jjin9
Reviewed-by: ZhangCaoIntel
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@11824 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/MdeModulePkg/Universal/Network/Ip4Dxe/Ip4Input.c b/MdeModulePkg/Universal/Network/Ip4Dxe/Ip4Input.c
index cfa13e45cb812067f2accaf7da8f01fc957d94e3..9cd1ae5cfc58758cf493dde8147a2cf3c97a6fbe 100644 (file)
--- a/MdeModulePkg/Universal/Network/Ip4Dxe/Ip4Input.c
+++ b/MdeModulePkg/Universal/Network/Ip4Dxe/Ip4Input.c
@@ -1,7 +1,7 @@
 /** @file\r
   IP4 input process.\r
   \r
-Copyright (c) 2005 - 2010, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2005 - 2011, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -583,11 +583,21 @@ Ip4IpSecProcessPacket (
   Ip4NtohHead (*Head);\r
   \r
   if (EFI_ERROR (Status)) {\r
+    FreePool (OriginalFragmentTable);\r
     goto ON_EXIT;\r
   }\r
 \r
   if (OriginalFragmentTable == FragmentTable && OriginalFragmentCount == FragmentCount) {\r
+    //\r
+    // For ByPass Packet\r
+    //\r
+    FreePool (FragmentTable);\r
     goto ON_EXIT;\r
+  } else {\r
+    //\r
+    // Free the FragmentTable which allocated before calling the IPsec.\r
+    //\r
+    FreePool (OriginalFragmentTable);\r
   }\r
 \r
   if (Direction == EfiIPsecOutBound && TxWrap != NULL) {\r
@@ -602,6 +612,11 @@ Ip4IpSecProcessPacket (
                                    TxWrap\r
                                    );\r
     if (TxWrap->Packet == NULL) {\r
+      //\r
+      // Recover the TxWrap->Packet, if meet a error, and the caller will free\r
+      // the TxWrap.\r
+      //\r
+      TxWrap->Packet = *Netbuf;\r
       Status = EFI_OUT_OF_RESOURCES;\r
       goto ON_EXIT;\r
     }\r
@@ -617,6 +632,8 @@ Ip4IpSecProcessPacket (
     IpSecWrap = AllocateZeroPool (sizeof (IP4_IPSEC_WRAP));\r
   \r
     if (IpSecWrap == NULL) {\r
+      Status = EFI_OUT_OF_RESOURCES;\r
+      gBS->SignalEvent (RecycleEvent);\r
       goto ON_EXIT;\r
     }\r
     \r
@@ -632,6 +649,9 @@ Ip4IpSecProcessPacket (
                                       );\r
   \r
     if (Packet == NULL) {\r
+      Packet = IpSecWrap->Packet;\r
+      gBS->SignalEvent (RecycleEvent);\r
+      FreePool (IpSecWrap);\r
       Status = EFI_OUT_OF_RESOURCES;\r
       goto ON_EXIT;\r
     }\r
@@ -848,11 +868,11 @@ Ip4AccpetFrame (
   // and no need consider any other ahead ext headers.\r
   //\r
   Status = Ip4IpSecProcessPacket (\r
-             IpSb, \r
-             &Head, \r
-             &Packet, \r
+             IpSb,\r
+             &Head,\r
+             &Packet,\r
              &Option,\r
-             &OptionLen, \r
+             &OptionLen,\r
              EfiIPsecInBound,\r
              NULL\r
              );\r
@@ -872,11 +892,11 @@ Ip4AccpetFrame (
   //\r
     Head = (IP4_HEAD *) NetbufGetByte (Packet, 0, NULL);\r
     Status = Ip4PreProcessPacket (\r
-               IpSb, \r
-               &Packet, \r
-               Head, \r
+               IpSb,\r
+               &Packet,\r
+               Head,\r
                Option,\r
-               OptionLen,  \r
+               OptionLen,\r
                Flag\r
                );\r
     if (EFI_ERROR (Status)) {\r

diff --git a/NetworkPkg/Ip6Dxe/Ip6Input.c b/NetworkPkg/Ip6Dxe/Ip6Input.c
index 89cdc3554264a5fc9c7803027204bc98d2c38f8d..3f0dce734393f929aabcb564c3c3e87127c98b27 100644 (file)
--- a/NetworkPkg/Ip6Dxe/Ip6Input.c
+++ b/NetworkPkg/Ip6Dxe/Ip6Input.c
@@ -1,7 +1,7 @@
 /** @file\r
   IP6 internal functions to process the incoming packets.\r
 \r
-  Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>\r
 \r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
@@ -613,6 +613,7 @@ Ip6IpSecProcessPacket (
   Ip6NtohHead (*Head);\r
 \r
   if (EFI_ERROR (Status)) {\r
+    FreePool (OriginalFragmentTable);\r
     goto ON_EXIT;\r
   }\r
 \r
@@ -620,7 +621,13 @@ Ip6IpSecProcessPacket (
     //\r
     // For ByPass Packet\r
     //\r
+    FreePool (FragmentTable);\r
     goto ON_EXIT;\r
+  } else {\r
+    //\r
+    // Free the FragmentTable which allocated before calling the IPsec.\r
+    //\r
+    FreePool (OriginalFragmentTable);\r
   }\r
 \r
   if (Direction == EfiIPsecOutBound && TxWrap != NULL) {\r
@@ -634,6 +641,7 @@ Ip6IpSecProcessPacket (
                                    TxWrap\r
                                    );\r
     if (TxWrap->Packet == NULL) {\r
+      TxWrap->Packet = *Netbuf;\r
       Status = EFI_OUT_OF_RESOURCES;\r
       goto ON_EXIT;\r
     }\r
@@ -652,6 +660,8 @@ Ip6IpSecProcessPacket (
     IpSecWrap = AllocateZeroPool (sizeof (IP6_IPSEC_WRAP));\r
 \r
     if (IpSecWrap == NULL) {\r
+      Status = EFI_OUT_OF_RESOURCES;\r
+      gBS->SignalEvent (RecycleEvent);\r
       goto ON_EXIT;\r
     }\r
 \r
@@ -667,6 +677,9 @@ Ip6IpSecProcessPacket (
                                       );\r
 \r
     if (Packet == NULL) {\r
+      Packet = IpSecWrap->Packet;\r
+      gBS->SignalEvent (RecycleEvent);\r
+      FreePool (IpSecWrap);\r
       Status = EFI_OUT_OF_RESOURCES;\r
       goto ON_EXIT;\r
     }\r
@@ -679,7 +692,8 @@ Ip6IpSecProcessPacket (
                                         NET_BUF_HEAD\r
                                         );\r
       if (PacketHead == NULL) {\r
-        Status = EFI_OUT_OF_RESOURCES;\r
+        *Netbuf = Packet;\r
+        Status  = EFI_OUT_OF_RESOURCES;\r
         goto ON_EXIT;\r
       }\r
 \r

diff --git a/NetworkPkg/IpSecDxe/IpSecImpl.c b/NetworkPkg/IpSecDxe/IpSecImpl.c
index 63abfa6ba67f410ff6d841f8fd1a55200e0b0ddc..fe3a604ee4b5987e9bdf8f51917b2b31b05e97ff 100644 (file)
--- a/NetworkPkg/IpSecDxe/IpSecImpl.c
+++ b/NetworkPkg/IpSecDxe/IpSecImpl.c
@@ -1596,7 +1596,7 @@ IpSecEspInboundPacket (
   //\r
   if (!SadData->Mode == EfiIPsecTunnel) {\r
     if (IpVersion == IP_VERSION_4) {\r
-      ((IP4_HEAD *) IpHead)->TotalLen = HTONS ((UINT16) (((IP4_HEAD *) IpHead)->HeadLen + PlainPayloadSize));\r
+      ((IP4_HEAD *) IpHead)->TotalLen = HTONS ((UINT16) ((((IP4_HEAD *) IpHead)->HeadLen << 2) + PlainPayloadSize));\r
     } else {\r
       IpSecHeadSize                              = IpSecGetPlainExtHeadSize (IpHead, LastHead);\r
       ((EFI_IP6_HEADER *) IpHead)->PayloadLength = HTONS ((UINT16)(IpSecHeadSize + PlainPayloadSize));\r