NetworkPkg: Fix SPD entry edit policy issue in IPSecConfig.

The current implementation doesn't handle the relationship
between SPD and SAD well, which may introduce some security
and connection issue after SPD updated.
For SPD entry edit policy, if one SPD entry is edited/updated,
the original SAs list should be discard. Current IPSecConfig
tool does not dealt properly with those rules.

Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19653 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/NetworkPkg/Application/IpsecConfig/PolicyEntryOperation.c b/NetworkPkg/Application/IpsecConfig/PolicyEntryOperation.c
index 970caa16ca0bc43aba7824ad452fb28c8dacd48f..9bbc11490c5430cfb883c9c444b99e6414235a59 100644 (file)
--- a/NetworkPkg/Application/IpsecConfig/PolicyEntryOperation.c
+++ b/NetworkPkg/Application/IpsecConfig/PolicyEntryOperation.c
@@ -1,7 +1,7 @@
 /** @file\r
   The implementation of policy entry operation function in IpSecConfig application.\r
 \r
 /** @file\r
   The implementation of policy entry operation function in IpSecConfig application.\r
 \r

-  Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>\r

 \r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
 \r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r


@@ -1398,6 +1398,8 @@ CombineSpdEntry (
   //\r
   // Process Data\r
   //\r
   //\r
   // Process Data\r
   //\r

+  OldData->SaIdCount = 0;\r
+\r

   if ((Mask & NAME) != 0) {\r
     AsciiStrCpyS ((CHAR8 *) OldData->Name, MAX_PEERID_LEN, (CHAR8 *) NewData->Name);\r
   }\r
   if ((Mask & NAME) != 0) {\r
     AsciiStrCpyS ((CHAR8 *) OldData->Name, MAX_PEERID_LEN, (CHAR8 *) NewData->Name);\r
   }\r


@@ -1862,37 +1864,30 @@ EditOperatePolicyEntry (
                &CreateNew\r
                );\r
     if (!EFI_ERROR (Status)) {\r
                &CreateNew\r
                );\r
     if (!EFI_ERROR (Status)) {\r

+      //\r
+      // If the Selector already existed, this Entry will be updated by set data.\r
+      //\r
+      Status = mIpSecConfig->SetData (\r
+                               mIpSecConfig,\r
+                               Context->DataType,\r
+                               Context->Selector, /// New created selector.\r
+                               Data, /// Old date which has been modified, need to be set data.\r
+                               Selector\r
+                               );\r
+      ASSERT_EFI_ERROR (Status);\r
+      \r

       if (CreateNew) {\r
         //\r
       if (CreateNew) {\r
         //\r

-        // Insert new entry before old entry\r
+        // Edit the entry to a new one. So, we need delete the old entry.\r

         //\r
         Status = mIpSecConfig->SetData (\r
                                  mIpSecConfig,\r
                                  Context->DataType,\r
         //\r
         Status = mIpSecConfig->SetData (\r
                                  mIpSecConfig,\r
                                  Context->DataType,\r

-                                 Context->Selector,\r
-                                 Data,\r
-                                 Selector\r
-                                 );\r
-        ASSERT_EFI_ERROR (Status);\r
-        //\r
-        // Delete old entry\r
-        //\r
-        Status = mIpSecConfig->SetData (\r
-                                 mIpSecConfig,\r
-                                 Context->DataType,\r
-                                 Selector,\r
-                                 NULL,\r
+                                 Selector, /// Old selector.\r
+                                 NULL, /// NULL means to delete this Entry specified by Selector.\r

                                  NULL\r
                                  );\r
         ASSERT_EFI_ERROR (Status);\r
                                  NULL\r
                                  );\r
         ASSERT_EFI_ERROR (Status);\r

-      } else {\r
-        Status = mIpSecConfig->SetData (\r
-                                 mIpSecConfig,\r
-                                 Context->DataType,\r
-                                 Context->Selector,\r
-                                 Data,\r
-                                 NULL\r
-                                 );\r

       }\r
     }\r
 \r
       }\r
     }\r
 \r