diff options
Diffstat (limited to 'NetworkPkg/IpSecDxe/Ikev2/Utility.h')
| -rw-r--r-- | NetworkPkg/IpSecDxe/Ikev2/Utility.h | 1061 |
1 files changed, 0 insertions, 1061 deletions
diff --git a/NetworkPkg/IpSecDxe/Ikev2/Utility.h b/NetworkPkg/IpSecDxe/Ikev2/Utility.h deleted file mode 100644 index ee466c05ac..0000000000 --- a/NetworkPkg/IpSecDxe/Ikev2/Utility.h +++ /dev/null @@ -1,1061 +0,0 @@ -/** @file
- The interfaces of IKE/Child session operations and payload related operations
- used by IKE Exchange Process.
-
- Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR>
-
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#ifndef _IKE_V2_UTILITY_H_
-#define _IKE_V2_UTILITY_H_
-
-#include "Ikev2.h"
-#include "IkeCommon.h"
-#include "IpSecCryptIo.h"
-
-#include <Library/PcdLib.h>
-
-#define IKEV2_SUPPORT_ENCRYPT_ALGORITHM_NUM 2
-#define IKEV2_SUPPORT_PRF_ALGORITHM_NUM 1
-#define IKEV2_SUPPORT_DH_ALGORITHM_NUM 2
-#define IKEV2_SUPPORT_AUTH_ALGORITHM_NUM 1
-
-/**
- Allocate buffer for IKEV2_SA_SESSION and initialize it.
-
- @param[in] Private Pointer to IPSEC_PRIVATE_DATA.
- @param[in] UdpService Pointer to IKE_UDP_SERVICE related to this IKE SA Session.
-
- @return Pointer to IKEV2_SA_SESSION.
-
-**/
-IKEV2_SA_SESSION *
-Ikev2SaSessionAlloc (
- IN IPSEC_PRIVATE_DATA *Private,
- IN IKE_UDP_SERVICE *UdpService
- );
-
-/**
- Register Establish IKEv2 SA into Private->Ikev2EstablishedList.
-
- @param[in] IkeSaSession Pointer to IKEV2_SA_SESSION to be registered.
- @param[in] Private Pointer to IPSEC_PRAVATE_DATA.
-
-**/
-VOID
-Ikev2SaSessionReg (
- IN IKEV2_SA_SESSION *IkeSaSession,
- IN IPSEC_PRIVATE_DATA *Private
- );
-
-/**
- Find a IKEV2_SA_SESSION by the remote peer IP.
-
- @param[in] SaSessionList SaSession List to be searched.
- @param[in] RemotePeerIp Pointer to specified IP address.
-
- @return Pointer to IKEV2_SA_SESSION if find one or NULL.
-
-**/
-IKEV2_SA_SESSION *
-Ikev2SaSessionLookup (
- IN LIST_ENTRY *SaSessionList,
- IN EFI_IP_ADDRESS *RemotePeerIp
- );
-
-/**
- Insert a IKE_SA_SESSION into IkeSaSession list. The IkeSaSession list is either
- Private->Ikev2SaSession list or Private->Ikev2EstablishedList list.
-
- @param[in] SaSessionList Pointer to list to be inserted into.
- @param[in] IkeSaSession Pointer to IKEV2_SA_SESSION to be inserted.
- @param[in] RemotePeerIp Pointer to EFI_IP_ADDRESSS to indicate the
- unique IKEV2_SA_SESSION.
-
-**/
-VOID
-Ikev2SaSessionInsert (
- IN LIST_ENTRY *SaSessionList,
- IN IKEV2_SA_SESSION *IkeSaSession,
- IN EFI_IP_ADDRESS *RemotePeerIp
- );
-
-/**
- Remove the SA Session by Remote Peer IP.
-
- @param[in] SaSessionList Pointer to list to be searched.
- @param[in] RemotePeerIp Pointer to EFI_IP_ADDRESS to use for SA Session search.
-
- @retval Pointer to IKEV2_SA_SESSION with the specified remote IP address.
-
-**/
-IKEV2_SA_SESSION *
-Ikev2SaSessionRemove (
- IN LIST_ENTRY *SaSessionList,
- IN EFI_IP_ADDRESS *RemotePeerIp
- );
-
-
-/**
- After IKE/Child SA is estiblished, close the time event and free sent packet.
-
- @param[in] SessionCommon Pointer to a Session Common.
-
-**/
-VOID
-Ikev2SessionCommonRefresh (
- IN IKEV2_SESSION_COMMON *SessionCommon
- );
-
-/**
- Free specified IKEV2 SA Session.
-
- @param[in] IkeSaSession Pointer to IKEV2_SA_SESSION to be freed.
-
-**/
-VOID
-Ikev2SaSessionFree (
- IN IKEV2_SA_SESSION *IkeSaSession
- );
-
-/**
- Free specified Seession Common. The session common would belong to a IKE SA or
- a Child SA.
-
- @param[in] SessionCommon Pointer to a Session Common.
-
-**/
-VOID
-Ikev2SaSessionCommonFree (
- IN IKEV2_SESSION_COMMON *SessionCommon
- );
-
-/**
- Increase the MessageID in IkeSaSession.
-
- @param[in] IkeSaSession Pointer to a specified IKEV2_SA_SESSION.
-
-**/
-VOID
-Ikev2SaSessionIncreaseMessageId (
- IN IKEV2_SA_SESSION *IkeSaSession
- );
-
-/**
- Allocate Momery for IKEV2 Child SA Session.
-
- @param[in] UdpService Pointer to IKE_UDP_SERVICE.
- @param[in] IkeSaSession Pointer to IKEV2_SA_SESSION related to this Child SA
- Session.
-
- @retval Pointer of a new created IKEV2 Child SA Session.
-
-**/
-IKEV2_CHILD_SA_SESSION *
-Ikev2ChildSaSessionAlloc (
- IN IKE_UDP_SERVICE *UdpService,
- IN IKEV2_SA_SESSION *IkeSaSession
- );
-
-/**
- Register a established IKEv2 Child SA into IkeSaSession->ChildSaEstablishSessionList.
- If the there is IKEV2_CHILD_SA_SESSION with same remote peer IP, remove the old one
- then register the new one.
-
- @param[in] ChildSaSession Pointer to IKEV2_CHILD_SA_SESSION to be registered.
- @param[in] Private Pointer to IPSEC_PRAVATE_DATA.
-
-**/
-VOID
-Ikev2ChildSaSessionReg (
- IN IKEV2_CHILD_SA_SESSION *ChildSaSession,
- IN IPSEC_PRIVATE_DATA *Private
- );
-
-/**
- This function find the Child SA by the specified Spi.
-
- This functin find a ChildSA session by searching the ChildSaSessionlist of
- the input IKEV2_SA_SESSION by specified MessageID.
-
- @param[in] SaSessionList Pointer to List to be searched.
- @param[in] Spi Specified SPI.
-
- @return Pointer to IKEV2_CHILD_SA_SESSION.
-
-**/
-IKEV2_CHILD_SA_SESSION *
-Ikev2ChildSaSessionLookupBySpi (
- IN LIST_ENTRY *SaSessionList,
- IN UINT32 Spi
- );
-
-
-/**
- Insert a Child SA Session into the specified ChildSa list..
-
- @param[in] SaSessionList Pointer to list to be inserted in.
- @param[in] ChildSaSession Pointer to IKEV2_CHILD_SA_SESSION to be inserted.
-
-**/
-VOID
-Ikev2ChildSaSessionInsert (
- IN LIST_ENTRY *SaSessionList,
- IN IKEV2_CHILD_SA_SESSION *ChildSaSession
- );
-
-/**
- Remove the IKEV2_CHILD_SA_SESSION from IkeSaSessionList.
-
- @param[in] SaSessionList The SA Session List to be iterated.
- @param[in] Spi Spi used to identify the IKEV2_CHILD_SA_SESSION.
- @param[in] ListType The type of the List to indicate whether it is a
- Established.
-
- @return The point to IKEV2_CHILD_SA_SESSION.
-
-**/
-IKEV2_CHILD_SA_SESSION *
-Ikev2ChildSaSessionRemove (
- IN LIST_ENTRY *SaSessionList,
- IN UINT32 Spi,
- IN UINT8 ListType
- );
-
-
-/**
- Free the memory located for the specified IKEV2_CHILD_SA_SESSION.
-
- @param[in] ChildSaSession Pointer to IKEV2_CHILD_SA_SESSION.
-
-**/
-VOID
-Ikev2ChildSaSessionFree (
- IN IKEV2_CHILD_SA_SESSION *ChildSaSession
- );
-
-/**
- Free the specified DhBuffer.
-
- @param[in] DhBuffer Pointer to IKEV2_DH_BUFFER to be freed.
-
-**/
-VOID
-Ikev2DhBufferFree (
- IN IKEV2_DH_BUFFER *DhBuffer
- );
-
-/**
- Delete the specified established Child SA.
-
- This function delete the Child SA directly and dont send the Information Packet to
- remote peer.
-
- @param[in] IkeSaSession Pointer to a IKE SA Session used to be searched for.
- @param[in] Spi SPI used to find the Child SA.
-
- @retval EFI_NOT_FOUND Pointer of IKE SA Session is NULL.
- @retval EFI_NOT_FOUND There is no specified Child SA related with the input
- SPI under this IKE SA Session.
- @retval EFI_SUCCESS Delete the Child SA successfully.
-
-**/
-EFI_STATUS
-Ikev2ChildSaSilentDelete (
- IN IKEV2_SA_SESSION *IkeSaSession,
- IN UINT32 Spi
- );
-
-/**
- This function is to parse a request IKE packet and return its request type.
- The request type is one of IKE CHILD SA creation, IKE SA rekeying and
- IKE CHILD SA rekeying.
-
- @param[in] IkePacket IKE packet to be prased.
-
- return the type of the IKE packet.
-
-**/
-IKEV2_CREATE_CHILD_REQUEST_TYPE
-Ikev2ChildExchangeRequestType(
- IN IKE_PACKET *IkePacket
- );
-
-
-/**
- Associate a SPD selector to the Child SA Session.
-
- This function is called when the Child SA is not the first child SA of its
- IKE SA. It associate a SPD to this Child SA.
-
- @param[in, out] ChildSaSession Pointer to the Child SA Session to be associated to
- a SPD selector.
-
- @retval EFI_SUCCESS Associate one SPD selector to this Child SA Session successfully.
- @retval EFI_NOT_FOUND Can't find the related SPD selector.
-
-**/
-EFI_STATUS
-Ikev2ChildSaAssociateSpdEntry (
- IN OUT IKEV2_CHILD_SA_SESSION *ChildSaSession
- );
-
-/**
- Validate the IKE header of received IKE packet.
-
- @param[in] IkeSaSession Pointer to IKEV2_SA_SESSION related to this IKE packet.
- @param[in] IkeHdr Pointer to IKE header of received IKE packet.
-
- @retval TRUE If the IKE header is valid.
- @retval FALSE If the IKE header is invalid.
-
-**/
-BOOLEAN
-Ikev2ValidateHeader (
- IN IKEV2_SA_SESSION *IkeSaSession,
- IN IKE_HEADER *IkeHdr
- );
-
-/**
- Create and intialize IKEV2_SA_DATA for speicifed IKEV2_SESSION_COMMON.
-
- This function will be only called by the initiator. The responder's IKEV2_SA_DATA
- will be generated during parsed the initiator packet.
-
- @param[in] SessionCommon Pointer to IKEV2_SESSION_COMMON related to.
-
- @retval a Pointer to a new IKEV2_SA_DATA or NULL.
-
-**/
-IKEV2_SA_DATA *
-Ikev2InitializeSaData (
- IN IKEV2_SESSION_COMMON *SessionCommon
- );
-
-/**
- Store the SA into SAD.
-
- @param[in] ChildSaSession Pointer to IKEV2_CHILD_SA_SESSION.
-
-**/
-VOID
-Ikev2StoreSaData (
- IN IKEV2_CHILD_SA_SESSION *ChildSaSession
- );
-
-/**
- Routine process before the payload decoding.
-
- @param[in] SessionCommon Pointer to ChildSa SessionCommon.
- @param[in] PayloadBuf Pointer to the payload.
- @param[in] PayloadSize Size of PayloadBuf in byte.
- @param[in] PayloadType Type of Payload.
-
-**/
-VOID
-Ikev2ChildSaBeforeDecodePayload (
- IN UINT8 *SessionCommon,
- IN UINT8 *PayloadBuf,
- IN UINTN PayloadSize,
- IN UINT8 PayloadType
- );
-
-/**
- Routine Process after the encode payload.
-
- @param[in] SessionCommon Pointer to ChildSa SessionCommon.
- @param[in] PayloadBuf Pointer to the payload.
- @param[in] PayloadSize Size of PayloadBuf in byte.
- @param[in] PayloadType Type of Payload.
-
-**/
-VOID
-Ikev2ChildSaAfterEncodePayload (
- IN UINT8 *SessionCommon,
- IN UINT8 *PayloadBuf,
- IN UINTN PayloadSize,
- IN UINT8 PayloadType
- );
-
-/**
- Generate Ikev2 SA payload according to SessionSaData
-
- @param[in] SessionSaData The data used in SA payload.
- @param[in] NextPayload The payload type presented in NextPayload field of
- SA Payload header.
- @param[in] Type The SA type. It MUST be neither (1) for IKE_SA or
- (2) for CHILD_SA or (3) for INFO.
-
- @retval a Pointer to SA IKE payload.
-
-**/
-IKE_PAYLOAD *
-Ikev2GenerateSaPayload (
- IN IKEV2_SA_DATA *SessionSaData,
- IN UINT8 NextPayload,
- IN IKE_SESSION_TYPE Type
- );
-
-/**
- Generate a ID payload.
-
- @param[in] CommonSession Pointer to IKEV2_SESSION_COMMON related to ID payload.
- @param[in] NextPayload The payload type presented in the NextPayload field
- of ID Payload header.
-
- @retval Pointer to ID IKE payload.
-
-**/
-IKE_PAYLOAD *
-Ikev2GenerateIdPayload (
- IN IKEV2_SESSION_COMMON *CommonSession,
- IN UINT8 NextPayload
- );
-
-/**
- Generate a ID payload.
-
- @param[in] CommonSession Pointer to IKEV2_SESSION_COMMON related to ID payload.
- @param[in] NextPayload The payload type presented in the NextPayload field
- of ID Payload header.
- @param[in] InCert Pointer to the Certificate which distinguished name
- will be added into the Id payload.
- @param[in] CertSize Size of the Certificate.
-
- @retval Pointer to ID IKE payload.
-
-**/
-IKE_PAYLOAD *
-Ikev2GenerateCertIdPayload (
- IN IKEV2_SESSION_COMMON *CommonSession,
- IN UINT8 NextPayload,
- IN UINT8 *InCert,
- IN UINTN CertSize
- );
-
-/**
- Generate a Nonce payload contenting the input parameter NonceBuf.
-
- @param[in] NonceBuf The nonce buffer content the whole Nonce payload block
- except the payload header.
- @param[in] NonceSize The buffer size of the NonceBuf
- @param[in] NextPayload The payload type presented in the NextPayload field
- of Nonce Payload header.
-
- @retval Pointer to Nonce IKE paload.
-
-**/
-IKE_PAYLOAD *
-Ikev2GenerateNoncePayload (
- IN UINT8 *NonceBuf,
- IN UINTN NonceSize,
- IN UINT8 NextPayload
- );
-
-/**
- Generate the Notify payload.
-
- Since the structure of Notify payload which defined in RFC 4306 is simple, so
- there is no internal data structure for Notify payload. This function generate
- Notify payload defined in RFC 4306, but all the fields in this payload are still
- in host order and need call Ikev2EncodePayload() to convert those fields from
- the host order to network order beforing sending it.
-
- @param[in] ProtocolId The protocol type ID. For IKE_SA it MUST be one (1).
- For IPsec SAs it MUST be neither (2) for AH or (3)
- for ESP.
- @param[in] NextPayload The next paylaod type in NextPayload field of
- the Notify payload.
- @param[in] SpiSize Size of the SPI in SPI size field of the Notify Payload.
- @param[in] MessageType The message type in NotifyMessageType field of the
- Notify Payload.
- @param[in] SpiBuf Pointer to buffer contains the SPI value.
- @param[in] NotifyData Pointer to buffer contains the notification data.
- @param[in] NotifyDataSize The size of NotifyData in bytes.
-
-
- @retval Pointer to IKE Notify Payload.
-
-**/
-IKE_PAYLOAD *
-Ikev2GenerateNotifyPayload (
- IN UINT8 ProtocolId,
- IN UINT8 NextPayload,
- IN UINT8 SpiSize,
- IN UINT16 MessageType,
- IN UINT8 *SpiBuf,
- IN UINT8 *NotifyData,
- IN UINTN NotifyDataSize
- );
-
-/**
- Generate the Delete payload.
-
- Since the structure of Delete payload which defined in RFC 4306 is simple,
- there is no internal data structure for Delete payload. This function generate
- Delete payload defined in RFC 4306, but all the fields in this payload are still
- in host order and need call Ikev2EncodePayload() to convert those fields from
- the host order to network order beforing sending it.
-
- @param[in] IkeSaSession Pointer to IKE SA Session to be used of Delete payload generation.
- @param[in] NextPayload The next paylaod type in NextPayload field of
- the Delete payload.
- @param[in] SpiSize Size of the SPI in SPI size field of the Delete Payload.
- @param[in] SpiNum Number of SPI in NumofSPIs field of the Delete Payload.
- @param[in] SpiBuf Pointer to buffer contains the SPI value.
-
- @retval Pointer to IKE Delete Payload.
-
-**/
-IKE_PAYLOAD *
-Ikev2GenerateDeletePayload (
- IN IKEV2_SA_SESSION *IkeSaSession,
- IN UINT8 NextPayload,
- IN UINT8 SpiSize,
- IN UINT16 SpiNum,
- IN UINT8 *SpiBuf
- );
-
-/**
- Generate the Configuration payload.
-
- This function generates a configuration payload defined in RFC 4306, but all the
- fields in this payload are still in host order and need call Ikev2EncodePayload()
- to convert those fields from the host order to network order beforing sending it.
-
- @param[in] IkeSaSession Pointer to IKE SA Session to be used for Delete payload
- generation.
- @param[in] NextPayload The next paylaod type in NextPayload field of
- the Delete payload.
- @param[in] CfgType The attribute type in the Configuration attribute.
-
- @retval Pointer to IKE CP Payload.
-
-**/
-IKE_PAYLOAD *
-Ikev2GenerateCpPayload (
- IN IKEV2_SA_SESSION *IkeSaSession,
- IN UINT8 NextPayload,
- IN UINT8 CfgType
- );
-
-/**
- Generate a Authentication Payload.
-
- This function is used for both Authentication generation and verification. When the
- IsVerify is TRUE, it create a Auth Data for verification. This function choose the
- related IKE_SA_INIT Message for Auth data creation according to the IKE Session's type
- and the value of IsVerify parameter.
-
- @param[in] IkeSaSession Pointer to IKEV2_SA_SESSION related to.
- @param[in] IdPayload Pointer to the ID payload to be used for Authentication
- payload generation.
- @param[in] NextPayload The type filled into the Authentication Payload next
- payload field.
- @param[in] IsVerify If it is TURE, the Authentication payload is used for
- verification.
-
- @return pointer to IKE Authentication payload for pre-shard key method.
-
-**/
-IKE_PAYLOAD *
-Ikev2PskGenerateAuthPayload (
- IN IKEV2_SA_SESSION *IkeSaSession,
- IN IKE_PAYLOAD *IdPayload,
- IN UINT8 NextPayload,
- IN BOOLEAN IsVerify
- );
-
-/**
- Generate a Authentication Payload for Certificate Auth method.
-
- This function has two functions. One is creating a local Authentication
- Payload for sending and other is creating the remote Authentication data
- for verification when the IsVerify is TURE.
-
- @param[in] IkeSaSession Pointer to IKEV2_SA_SESSION related to.
- @param[in] IdPayload Pointer to the ID payload to be used for Authentication
- payload generation.
- @param[in] NextPayload The type filled into the Authentication Payload
- next payload field.
- @param[in] IsVerify If it is TURE, the Authentication payload is used
- for verification.
- @param[in] UefiPrivateKey Pointer to the UEFI private key. Ignore it when
- verify the authenticate payload.
- @param[in] UefiPrivateKeyLen The size of UefiPrivateKey in bytes. Ignore it
- when verify the authenticate payload.
- @param[in] UefiKeyPwd Pointer to the password of UEFI private key.
- Ignore it when verify the authenticate payload.
- @param[in] UefiKeyPwdLen The size of UefiKeyPwd in bytes.Ignore it when
- verify the authenticate payload.
-
- @return pointer to IKE Authentication payload for certification method.
-
-**/
-IKE_PAYLOAD *
-Ikev2CertGenerateAuthPayload (
- IN IKEV2_SA_SESSION *IkeSaSession,
- IN IKE_PAYLOAD *IdPayload,
- IN UINT8 NextPayload,
- IN BOOLEAN IsVerify,
- IN UINT8 *UefiPrivateKey,
- IN UINTN UefiPrivateKeyLen,
- IN UINT8 *UefiKeyPwd,
- IN UINTN UefiKeyPwdLen
- );
-
-/**
- Generate TS payload.
-
- This function generates TSi or TSr payload according to type of next payload.
- If the next payload is Responder TS, gereate TSi Payload. Otherwise, generate
- TSr payload
-
- @param[in] ChildSa Pointer to IKEV2_CHILD_SA_SESSION related to this TS payload.
- @param[in] NextPayload The payload type presented in the NextPayload field
- of ID Payload header.
- @param[in] IsTunnel It indicates that if the Ts Payload is after the CP payload.
- If yes, it means the Tsi and Tsr payload should be with
- Max port range and address range and protocol is marked
- as zero.
-
- @retval Pointer to Ts IKE payload.
-
-**/
-IKE_PAYLOAD *
-Ikev2GenerateTsPayload (
- IN IKEV2_CHILD_SA_SESSION *ChildSa,
- IN UINT8 NextPayload,
- IN BOOLEAN IsTunnel
- );
-
-/**
- Parser the Notify Cookie payload.
-
- This function parses the Notify Cookie payload.If the Notify ProtocolId is not
- IPSEC_PROTO_ISAKMP or if the SpiSize is not zero or if the MessageType is not
- the COOKIE, return EFI_INVALID_PARAMETER.
-
- @param[in] IkeNCookie Pointer to the IKE_PAYLOAD which contians the
- Notify Cookie payload.
- the Notify payload.
- @param[in, out] IkeSaSession Pointer to the relevant IKE SA Session.
-
- @retval EFI_SUCCESS The Notify Cookie Payload is valid.
- @retval EFI_INVALID_PARAMETER The Notify Cookie Payload is invalid.
- @retval EFI_OUT_OF_RESOURCE The required resource can't be allocated.
-
-**/
-EFI_STATUS
-Ikev2ParserNotifyCookiePayload (
- IN IKE_PAYLOAD *IkeNCookie,
- IN OUT IKEV2_SA_SESSION *IkeSaSession
- );
-
-/**
- Generate the Certificate payload or Certificate Request Payload.
-
- Since the Certificate Payload structure is same with Certificate Request Payload,
- the only difference is that one contains the Certificate Data, other contains
- the acceptable certificateion CA. This function generate Certificate payload
- or Certificate Request Payload defined in RFC 4306, but all the fields
- in the payload are still in host order and need call Ikev2EncodePayload()
- to convert those fields from the host order to network order beforing sending it.
-
- @param[in] IkeSaSession Pointer to IKE SA Session to be used of Delete payload
- generation.
- @param[in] NextPayload The next paylaod type in NextPayload field of
- the Delete payload.
- @param[in] Certificate Pointer of buffer contains the certification data.
- @param[in] CertificateLen The length of Certificate in byte.
- @param[in] EncodeType Specified the Certificate Encodeing which is defined
- in RFC 4306.
- @param[in] IsRequest To indicate create Certificate Payload or Certificate
- Request Payload. If it is TURE, create Certificate
- Request Payload. Otherwise, create Certificate Payload.
-
- @retval a Pointer to IKE Payload whose payload buffer containing the Certificate
- payload or Certificated Request payload.
-
-**/
-IKE_PAYLOAD *
-Ikev2GenerateCertificatePayload (
- IN IKEV2_SA_SESSION *IkeSaSession,
- IN UINT8 NextPayload,
- IN UINT8 *Certificate,
- IN UINTN CertificateLen,
- IN UINT8 EncodeType,
- IN BOOLEAN IsRequest
- );
-
-/**
- General interface of payload encoding.
-
- This function encode the internal data structure into payload which
- is defined in RFC 4306. The IkePayload->PayloadBuf used to store both the input
- payload and converted payload. Only the SA payload use the interal structure
- to store the attribute. Other payload use structure which is same with the RFC
- defined, for this kind payloads just do host order to network order change of
- some fields.
-
- @param[in] SessionCommon Pointer to IKE Session Common used to encode the payload.
- @param[in, out] IkePayload Pointer to IKE payload to be encode as input, and
- store the encoded result as output.
-
- @retval EFI_INVALID_PARAMETER Meet error when encode the SA payload.
- @retval EFI_SUCCESS Encode successfully.
-
-**/
-EFI_STATUS
-Ikev2EncodePayload (
- IN UINT8 *SessionCommon,
- IN OUT IKE_PAYLOAD *IkePayload
- );
-
-/**
- The general interface of decode Payload.
-
- This function convert the received Payload into internal structure.
-
- @param[in] SessionCommon Pointer to IKE Session Common to use for decoding.
- @param[in, out] IkePayload Pointer to IKE payload to be decode as input, and
- store the decoded result as output.
-
- @retval EFI_INVALID_PARAMETER Meet error when decode the SA payload.
- @retval EFI_SUCCESS Decode successfully.
-
-**/
-EFI_STATUS
-Ikev2DecodePayload (
- IN UINT8 *SessionCommon,
- IN OUT IKE_PAYLOAD *IkePayload
- );
-
-/**
- Decrypt IKE packet.
-
- This function decrpt the Encrypted IKE packet and put the result into IkePacket->PayloadBuf.
-
- @param[in] SessionCommon Pointer to IKEV2_SESSION_COMMON containing
- some parameter used during decrypting.
- @param[in, out] IkePacket Point to IKE_PACKET to be decrypted as input,
- and the decrypted reslult as output.
- @param[in, out] IkeType The type of IKE. IKE_SA_TYPE, IKE_INFO_TYPE and
- IKE_CHILD_TYPE are supportted.
-
- @retval EFI_INVALID_PARAMETER If the IKE packet length is zero or the
- IKE packet length is not Algorithm Block Size
- alignment.
- @retval EFI_SUCCESS Decrypt IKE packet successfully.
-
-**/
-EFI_STATUS
-Ikev2DecryptPacket (
- IN IKEV2_SESSION_COMMON *SessionCommon,
- IN OUT IKE_PACKET *IkePacket,
- IN OUT UINTN IkeType
- );
-
-/**
- Encrypt IKE packet.
-
- This function encrypt IKE packet before sending it. The Encrypted IKE packet
- is put in to IKEV2 Encrypted Payload.
-
- @param[in] SessionCommon Pointer to IKEV2_SESSION_COMMON related to the IKE packet.
- @param[in, out] IkePacket Pointer to IKE packet to be encrypted.
-
- @retval EFI_SUCCESS Operation is successful.
- @retval Others OPeration is failed.
-
-**/
-EFI_STATUS
-Ikev2EncryptPacket (
- IN IKEV2_SESSION_COMMON *SessionCommon,
- IN OUT IKE_PACKET *IkePacket
- );
-
-/**
- Encode the IKE packet.
-
- This function put all Payloads into one payload then encrypt it if needed.
-
- @param[in] SessionCommon Pointer to IKEV2_SESSION_COMMON containing
- some parameter used during IKE packet encoding.
- @param[in, out] IkePacket Pointer to IKE_PACKET to be encoded as input,
- and the encoded reslult as output.
- @param[in] IkeType The type of IKE. IKE_SA_TYPE, IKE_INFO_TYPE and
- IKE_CHILD_TYPE are supportted.
-
- @retval EFI_SUCCESS Encode IKE packet successfully.
- @retval Otherwise Encode IKE packet failed.
-
-**/
-EFI_STATUS
-Ikev2EncodePacket (
- IN IKEV2_SESSION_COMMON *SessionCommon,
- IN OUT IKE_PACKET *IkePacket,
- IN UINTN IkeType
- );
-
-/**
- Decode the IKE packet.
-
- This function first decrypts the IKE packet if needed , then separats the whole
- IKE packet from the IkePacket->PayloadBuf into IkePacket payload list.
-
- @param[in] SessionCommon Pointer to IKEV1_SESSION_COMMON containing
- some parameter used by IKE packet decoding.
- @param[in, out] IkePacket The IKE Packet to be decoded on input, and
- the decoded result on return.
- @param[in] IkeType The type of IKE. IKE_SA_TYPE, IKE_INFO_TYPE and
- IKE_CHILD_TYPE are supportted.
-
- @retval EFI_SUCCESS The IKE packet is decoded successfull.
- @retval Otherwise The IKE packet decoding is failed.
-
-**/
-EFI_STATUS
-Ikev2DecodePacket (
- IN IKEV2_SESSION_COMMON *SessionCommon,
- IN OUT IKE_PACKET *IkePacket,
- IN UINTN IkeType
- );
-
-
-/**
- Send out IKEV2 packet.
-
- @param[in] IkeUdpService Pointer to IKE_UDP_SERVICE used to send the IKE packet.
- @param[in] SessionCommon Pointer to IKEV1_SESSION_COMMON related to the IKE packet.
- @param[in] IkePacket Pointer to IKE_PACKET to be sent out.
- @param[in] IkeType The type of IKE to point what's kind of the IKE
- packet is to be sent out. IKE_SA_TYPE, IKE_INFO_TYPE
- and IKE_CHILD_TYPE are supportted.
-
- @retval EFI_SUCCESS The operation complete successfully.
- @retval Otherwise The operation is failed.
-
-**/
-EFI_STATUS
-Ikev2SendIkePacket (
- IN IKE_UDP_SERVICE *IkeUdpService,
- IN UINT8 *SessionCommon,
- IN IKE_PACKET *IkePacket,
- IN UINTN IkeType
- );
-
-/**
- Callback function for the IKE life time is over.
-
- This function will mark the related IKE SA Session as deleting and trigger a
- Information negotiation.
-
- @param[in] Event The time out event.
- @param[in] Context Pointer to data passed by caller.
-
-**/
-VOID
-EFIAPI
-Ikev2LifetimeNotify (
- IN EFI_EVENT Event,
- IN VOID *Context
- );
-
-/**
- This function will be called if the TimeOut Event is signaled.
-
- @param[in] Event The signaled Event.
- @param[in] Context The data passed by caller.
-
-**/
-VOID
-EFIAPI
-Ikev2ResendNotify (
- IN EFI_EVENT Event,
- IN VOID *Context
- );
-
-/**
- Generate a Key Exchange payload according to the DH group type and save the
- public Key into IkeSaSession IkeKey field.
-
- @param[in, out] IkeSaSession Pointer of the IKE_SA_SESSION.
- @param[in] NextPayload The payload type presented in the NextPayload field of Key
- Exchange Payload header.
-
- @retval Pointer to Key IKE payload.
-
-**/
-IKE_PAYLOAD *
-Ikev2GenerateKePayload (
- IN OUT IKEV2_SA_SESSION *IkeSaSession,
- IN UINT8 NextPayload
- );
-
-/**
- Check if the SPD is related to the input Child SA Session.
-
- This function is the subfunction of Ikev1AssociateSpdEntry(). It is the call
- back function of IpSecVisitConfigData().
-
-
- @param[in] Type Type of the input Config Selector.
- @param[in] Selector Pointer to the Configure Selector to be checked.
- @param[in] Data Pointer to the Configure Selector's Data passed
- from the caller.
- @param[in] SelectorSize The buffer size of Selector.
- @param[in] DataSize The buffer size of the Data.
- @param[in] Context The data passed from the caller. It is a Child
- SA Session in this context.
-
- @retval EFI_SUCCESS The SPD Selector is not related to the Child SA Session.
- @retval EFI_ABORTED The SPD Selector is related to the Child SA session and
- set the ChildSaSession->Spd to point to this SPD Selector.
-
-**/
-EFI_STATUS
-Ikev2MatchSpdEntry (
- IN EFI_IPSEC_CONFIG_DATA_TYPE Type,
- IN EFI_IPSEC_CONFIG_SELECTOR *Selector,
- IN VOID *Data,
- IN UINTN SelectorSize,
- IN UINTN DataSize,
- IN VOID *Context
- );
-
-/**
- Check if the Algorithm ID is supported.
-
- @param[in] AlgorithmId The specified Algorithm ID.
- @param[in] Type The type used to indicate the Algorithm is for Encrypt or
- Authentication.
-
- @retval TRUE If the Algorithm ID is supported.
- @retval FALSE If the Algorithm ID is not supported.
-
-**/
-BOOLEAN
-Ikev2IsSupportAlg (
- IN UINT16 AlgorithmId,
- IN UINT8 Type
- );
-
-/**
- Generate a ChildSa Session and insert it into related IkeSaSession.
-
- @param[in] IkeSaSession Pointer to related IKEV2_SA_SESSION.
- @param[in] UdpService Pointer to related IKE_UDP_SERVICE.
-
- @return pointer of IKEV2_CHILD_SA_SESSION.
-
-**/
-IKEV2_CHILD_SA_SESSION *
-Ikev2ChildSaSessionCreate (
- IN IKEV2_SA_SESSION *IkeSaSession,
- IN IKE_UDP_SERVICE *UdpService
- ) ;
-
-/**
- Parse the received Initial Exchange Packet.
-
- This function parse the SA Payload and Key Payload to find out the cryptographic
- suite for the further IKE negotiation and fill it into the IKE SA Session's
- CommonSession->SaParams.
-
- @param[in, out] IkeSaSession Pointer to related IKEV2_SA_SESSION.
- @param[in] SaPayload The received packet.
- @param[in] Type The received packet IKE header flag.
-
- @retval TRUE If the SA proposal in Packet is acceptable.
- @retval FALSE If the SA proposal in Packet is not acceptable.
-
-**/
-BOOLEAN
-Ikev2SaParseSaPayload (
- IN OUT IKEV2_SA_SESSION *IkeSaSession,
- IN IKE_PAYLOAD *SaPayload,
- IN UINT8 Type
- );
-
-/**
- Parse the received Authentication Exchange Packet.
-
- This function parse the SA Payload and Key Payload to find out the cryptographic
- suite for the ESP and fill it into the Child SA Session's CommonSession->SaParams.
-
- @param[in, out] ChildSaSession Pointer to IKEV2_CHILD_SA_SESSION related to
- this Authentication Exchange.
- @param[in] SaPayload The received packet.
- @param[in] Type The IKE header's flag of received packet .
-
- @retval TRUE If the SA proposal in Packet is acceptable.
- @retval FALSE If the SA proposal in Packet is not acceptable.
-
-**/
-BOOLEAN
-Ikev2ChildSaParseSaPayload (
- IN OUT IKEV2_CHILD_SA_SESSION *ChildSaSession,
- IN IKE_PAYLOAD *SaPayload,
- IN UINT8 Type
- );
-
-/**
- Generate Key buffer from fragments.
-
- If the digest length of specified HashAlgId is larger than or equal with the
- required output key length, derive the key directly. Otherwise, Key Material
- needs to be PRF-based concatenation according to 2.13 of RFC 4306:
- prf+ (K,S) = T1 | T2 | T3 | T4 | ..., T1 = prf (K, S | 0x01),
- T2 = prf (K, T1 | S | 0x02), T3 = prf (K, T2 | S | 0x03),T4 = prf (K, T3 | S | 0x04)
- then derive the key from this key material.
-
- @param[in] HashAlgId The Hash Algorithm ID used to generate key.
- @param[in] HashKey Pointer to a key buffer which contains hash key.
- @param[in] HashKeyLength The length of HashKey in bytes.
- @param[in, out] OutputKey Pointer to buffer which is used to receive the
- output key.
- @param[in] OutputKeyLength The length of OutPutKey buffer.
- @param[in] Fragments Pointer to the data to be used to generate key.
- @param[in] NumFragments The numbers of the Fragement.
-
- @retval EFI_SUCCESS The operation complete successfully.
- @retval EFI_INVALID_PARAMETER If NumFragments is zero.
- @retval EFI_OUT_OF_RESOURCES If the required resource can't be allocated.
- @retval Others The operation is failed.
-
-**/
-EFI_STATUS
-Ikev2SaGenerateKey (
- IN UINT8 HashAlgId,
- IN UINT8 *HashKey,
- IN UINTN HashKeyLength,
- IN OUT UINT8 *OutputKey,
- IN UINTN OutputKeyLength,
- IN PRF_DATA_FRAGMENT *Fragments,
- IN UINTN NumFragments
- );
-
-/**
- Copy ChildSaSession->Spd->Selector to ChildSaSession->SpdSelector.
-
- ChildSaSession->SpdSelector stores the real Spdselector for its SA. Sometime,
- the SpdSelector in ChildSaSession is more accurated or the scope is smaller
- than the one in ChildSaSession->Spd, especially for the tunnel mode.
-
- @param[in, out] ChildSaSession Pointer to IKEV2_CHILD_SA_SESSION related to.
-
- @retval EFI_SUCCESS The operation complete successfully.
- @retval EFI_OUT_OF_RESOURCES If the required resource can't be allocated.
-
-**/
-EFI_STATUS
-Ikev2ChildSaSessionSpdSelectorCreate (
- IN OUT IKEV2_CHILD_SA_SESSION *ChildSaSession
- );
-
-extern IKE_ALG_GUID_INFO mIPsecEncrAlgInfo[];
-#endif
-
|