IpSecConfig.c 26 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806
  1. /** @file
  2. The main process for IpSecConfig application.
  3. Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
  4. SPDX-License-Identifier: BSD-2-Clause-Patent
  5. **/
  6. #include <Library/UefiRuntimeServicesTableLib.h>
  7. #include <Library/HiiLib.h>
  8. #include <Protocol/IpSec.h>
  9. #include "IpSecConfig.h"
  10. #include "Dump.h"
  11. #include "Indexer.h"
  12. #include "PolicyEntryOperation.h"
  13. #include "Delete.h"
  14. #include "Helper.h"
  15. //
  16. // String token ID of IpSecConfig command help message text.
  17. //
  18. GLOBAL_REMOVE_IF_UNREFERENCED EFI_STRING_ID mStringIpSecHelpTokenId = STRING_TOKEN (STR_IPSEC_CONFIG_HELP);
  19. //
  20. // Used for ShellCommandLineParseEx only
  21. // and to ensure user inputs are in valid format
  22. //
  23. SHELL_PARAM_ITEM mIpSecConfigParamList[] = {
  24. { L"-p", TypeValue },
  25. { L"-a", TypeValue },
  26. { L"-i", TypeValue },
  27. { L"-e", TypeValue },
  28. { L"-d", TypeValue },
  29. { L"-f", TypeFlag },
  30. { L"-l", TypeFlag },
  31. { L"-enable", TypeFlag },
  32. { L"-disable", TypeFlag },
  33. { L"-status", TypeFlag },
  34. //
  35. // SPD Selector
  36. //
  37. { L"--local", TypeValue },
  38. { L"--remote", TypeValue },
  39. { L"--proto", TypeValue },
  40. { L"--local-port", TypeValue },
  41. { L"--remote-port", TypeValue },
  42. { L"--icmp-type", TypeValue },
  43. { L"--icmp-code", TypeValue },
  44. //
  45. // SPD Data
  46. //
  47. { L"--name", TypeValue },
  48. { L"--packet-flag", TypeValue },
  49. { L"--action", TypeValue },
  50. { L"--lifebyte", TypeValue },
  51. { L"--lifetime-soft", TypeValue },
  52. { L"--lifetime", TypeValue },
  53. { L"--mode", TypeValue },
  54. { L"--tunnel-local", TypeValue },
  55. { L"--tunnel-remote", TypeValue },
  56. { L"--dont-fragment", TypeValue },
  57. { L"--ipsec-proto", TypeValue },
  58. { L"--auth-algo", TypeValue },
  59. { L"--encrypt-algo", TypeValue },
  60. { L"--ext-sequence", TypeFlag },
  61. { L"--sequence-overflow", TypeFlag },
  62. { L"--fragment-check", TypeFlag },
  63. { L"--ext-sequence-", TypeFlag },
  64. { L"--sequence-overflow-", TypeFlag },
  65. { L"--fragment-check-", TypeFlag },
  66. //
  67. // SA ID
  68. // --ipsec-proto
  69. //
  70. { L"--spi", TypeValue },
  71. { L"--tunnel-dest", TypeValue },
  72. { L"--tunnel-source", TypeValue },
  73. { L"--lookup-spi", TypeValue },
  74. { L"--lookup-ipsec-proto", TypeValue },
  75. { L"--lookup-dest", TypeValue },
  76. //
  77. // SA DATA
  78. // --mode
  79. // --auth-algo
  80. // --encrypt-algo
  81. //
  82. { L"--sequence-number", TypeValue },
  83. { L"--antireplay-window", TypeValue },
  84. { L"--auth-key", TypeValue },
  85. { L"--encrypt-key", TypeValue },
  86. { L"--path-mtu", TypeValue },
  87. //
  88. // PAD ID
  89. //
  90. { L"--peer-id", TypeValue },
  91. { L"--peer-address", TypeValue },
  92. { L"--auth-proto", TypeValue },
  93. { L"--auth-method", TypeValue },
  94. { L"--ike-id", TypeValue },
  95. { L"--ike-id-", TypeValue },
  96. { L"--auth-data", TypeValue },
  97. { L"--revocation-data", TypeValue },
  98. { L"--lookup-peer-id", TypeValue },
  99. { L"--lookup-peer-address", TypeValue },
  100. { NULL, TypeMax },
  101. };
  102. //
  103. // -P
  104. //
  105. STR2INT mMapPolicy[] = {
  106. { L"SPD", IPsecConfigDataTypeSpd },
  107. { L"SAD", IPsecConfigDataTypeSad },
  108. { L"PAD", IPsecConfigDataTypePad },
  109. { NULL, 0 },
  110. };
  111. //
  112. // --proto
  113. //
  114. STR2INT mMapIpProtocol[] = {
  115. { L"TCP", EFI_IP4_PROTO_TCP },
  116. { L"UDP", EFI_IP4_PROTO_UDP },
  117. { L"ICMP", EFI_IP4_PROTO_ICMP },
  118. { NULL, 0 },
  119. };
  120. //
  121. // --action
  122. //
  123. STR2INT mMapIpSecAction[] = {
  124. { L"Bypass", EfiIPsecActionBypass },
  125. { L"Discard", EfiIPsecActionDiscard },
  126. { L"Protect", EfiIPsecActionProtect },
  127. { NULL, 0 },
  128. };
  129. //
  130. // --mode
  131. //
  132. STR2INT mMapIpSecMode[] = {
  133. { L"Transport", EfiIPsecTransport },
  134. { L"Tunnel", EfiIPsecTunnel },
  135. { NULL, 0 },
  136. };
  137. //
  138. // --dont-fragment
  139. //
  140. STR2INT mMapDfOption[] = {
  141. { L"clear", EfiIPsecTunnelClearDf },
  142. { L"set", EfiIPsecTunnelSetDf },
  143. { L"copy", EfiIPsecTunnelCopyDf },
  144. { NULL, 0 },
  145. };
  146. //
  147. // --ipsec-proto
  148. //
  149. STR2INT mMapIpSecProtocol[] = {
  150. { L"AH", EfiIPsecAH },
  151. { L"ESP", EfiIPsecESP },
  152. { NULL, 0 },
  153. };
  154. //
  155. // --auth-algo
  156. //
  157. STR2INT mMapAuthAlgo[] = {
  158. { L"NONE", IPSEC_AALG_NONE },
  159. { L"MD5HMAC", IPSEC_AALG_MD5HMAC },
  160. { L"SHA1HMAC", IPSEC_AALG_SHA1HMAC },
  161. { L"SHA2-256HMAC", IPSEC_AALG_SHA2_256HMAC },
  162. { L"SHA2-384HMAC", IPSEC_AALG_SHA2_384HMAC },
  163. { L"SHA2-512HMAC", IPSEC_AALG_SHA2_512HMAC },
  164. { L"AES-XCBC-MAC", IPSEC_AALG_AES_XCBC_MAC },
  165. { L"NULL", IPSEC_AALG_NULL },
  166. { NULL, 0 },
  167. };
  168. //
  169. // --encrypt-algo
  170. //
  171. STR2INT mMapEncAlgo[] = {
  172. { L"NONE", IPSEC_EALG_NONE },
  173. { L"DESCBC", IPSEC_EALG_DESCBC },
  174. { L"3DESCBC", IPSEC_EALG_3DESCBC },
  175. { L"CASTCBC", IPSEC_EALG_CASTCBC },
  176. { L"BLOWFISHCBC", IPSEC_EALG_BLOWFISHCBC },
  177. { L"NULL", IPSEC_EALG_NULL },
  178. { L"AESCBC", IPSEC_EALG_AESCBC },
  179. { L"AESCTR", IPSEC_EALG_AESCTR },
  180. { L"AES-CCM-ICV8", IPSEC_EALG_AES_CCM_ICV8 },
  181. { L"AES-CCM-ICV12",IPSEC_EALG_AES_CCM_ICV12 },
  182. { L"AES-CCM-ICV16",IPSEC_EALG_AES_CCM_ICV16 },
  183. { L"AES-GCM-ICV8", IPSEC_EALG_AES_GCM_ICV8 },
  184. { L"AES-GCM-ICV12",IPSEC_EALG_AES_GCM_ICV12 },
  185. { L"AES-GCM-ICV16",IPSEC_EALG_AES_GCM_ICV16 },
  186. { NULL, 0 },
  187. };
  188. //
  189. // --auth-proto
  190. //
  191. STR2INT mMapAuthProto[] = {
  192. { L"IKEv1", EfiIPsecAuthProtocolIKEv1 },
  193. { L"IKEv2", EfiIPsecAuthProtocolIKEv2 },
  194. { NULL, 0 },
  195. };
  196. //
  197. // --auth-method
  198. //
  199. STR2INT mMapAuthMethod[] = {
  200. { L"PreSharedSecret", EfiIPsecAuthMethodPreSharedSecret },
  201. { L"Certificates", EfiIPsecAuthMethodCertificates },
  202. { NULL, 0 },
  203. };
  204. EFI_IPSEC2_PROTOCOL *mIpSec;
  205. EFI_IPSEC_CONFIG_PROTOCOL *mIpSecConfig;
  206. EFI_HII_HANDLE mHiiHandle;
  207. CHAR16 mAppName[] = L"IpSecConfig";
  208. //
  209. // Used for IpSecConfigRetriveCheckListByName only to check the validation of user input
  210. //
  211. VAR_CHECK_ITEM mIpSecConfigVarCheckList[] = {
  212. { L"-enable", BIT(1)|BIT(0), BIT(1), BIT(2)|BIT(1)|BIT(0), 0 },
  213. { L"-disable", BIT(1)|BIT(0), BIT(1), BIT(2)|BIT(1)|BIT(0), 0 },
  214. { L"-status", BIT(1)|BIT(0), BIT(1), BIT(2)|BIT(1)|BIT(0), 0 },
  215. { L"-p", BIT(1), 0, BIT(2)|BIT(1)|BIT(0), 0 },
  216. { L"-a", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
  217. { L"-i", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
  218. { L"-d", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
  219. { L"-e", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
  220. { L"-l", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
  221. { L"-f", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
  222. { L"-?", BIT(0), BIT(0), BIT(2)|BIT(1)|BIT(0), 0 },
  223. //
  224. // SPD Selector
  225. //
  226. { L"--local", 0, 0, BIT(2)|BIT(1), 0 },
  227. { L"--remote", 0, 0, BIT(2)|BIT(1), 0 },
  228. { L"--proto", 0, 0, BIT(2)|BIT(1), 0 },
  229. { L"--local-port", 0, 0, BIT(2)|BIT(1), BIT(0) },
  230. { L"--remote-port", 0, 0, BIT(2)|BIT(1), BIT(0) },
  231. { L"--icmp-type", 0, 0, BIT(2)|BIT(1), BIT(1) },
  232. { L"--icmp-code", 0, 0, BIT(2)|BIT(1), BIT(1) },
  233. //
  234. // SPD Data
  235. //
  236. { L"--name", 0, 0, BIT(2), 0 },
  237. { L"--packet-flag", 0, 0, BIT(2), 0 },
  238. { L"--action", 0, 0, BIT(2)|BIT(1), 0 },
  239. { L"--lifebyte", 0, 0, BIT(2)|BIT(1), 0 },
  240. { L"--lifetime-soft", 0, 0, BIT(2)|BIT(1), 0 },
  241. { L"--lifetime", 0, 0, BIT(2)|BIT(1), 0 },
  242. { L"--mode", 0, 0, BIT(2)|BIT(1), 0 },
  243. { L"--tunnel-local", 0, 0, BIT(2), 0 },
  244. { L"--tunnel-remote", 0, 0, BIT(2), 0 },
  245. { L"--dont-fragment", 0, 0, BIT(2), 0 },
  246. { L"--ipsec-proto", 0, 0, BIT(2)|BIT(1), 0 },
  247. { L"--auth-algo", 0, 0, BIT(2)|BIT(1), 0 },
  248. { L"--encrypt-algo", 0, 0, BIT(2)|BIT(1), 0 },
  249. { L"--ext-sequence", 0, 0, BIT(2), BIT(2) },
  250. { L"--sequence-overflow", 0, 0, BIT(2), BIT(2) },
  251. { L"--fragment-check", 0, 0, BIT(2), BIT(2) },
  252. { L"--ext-sequence-", 0, 0, BIT(2), BIT(3) },
  253. { L"--sequence-overflow-", 0, 0, BIT(2), BIT(3) },
  254. { L"--fragment-check-", 0, 0, BIT(2), BIT(3) },
  255. //
  256. // SA ID
  257. // --ipsec-proto
  258. //
  259. { L"--spi", 0, 0, BIT(1), 0 },
  260. { L"--tunnel-dest", 0, 0, BIT(1), 0 },
  261. { L"--tunnel-source", 0, 0, BIT(1), 0 },
  262. { L"--lookup-spi", 0, 0, BIT(1), 0 },
  263. { L"--lookup-ipsec-proto", 0, 0, BIT(1), 0 },
  264. { L"--lookup-dest", 0, 0, BIT(1), 0 },
  265. //
  266. // SA DATA
  267. // --mode
  268. // --auth-algo
  269. // --encrypt-algo
  270. //
  271. { L"--sequence-number", 0, 0, BIT(1), 0 },
  272. { L"--antireplay-window", 0, 0, BIT(1), 0 },
  273. { L"--auth-key", 0, 0, BIT(1), 0 },
  274. { L"--encrypt-key", 0, 0, BIT(1), 0 },
  275. { L"--path-mtu", 0, 0, BIT(1), 0 },
  276. //
  277. // The example to add a PAD:
  278. // "-A --peer-id Mike [--peer-address 10.23.2.2] --auth-proto IKE1/IKE2
  279. // --auth-method PreSharedSeceret/Certificate --ike-id
  280. // --auth-data 343343 --revocation-data 2342432"
  281. // The example to delete a PAD:
  282. // "-D * --lookup-peer-id Mike [--lookup-peer-address 10.23.2.2]"
  283. // "-D 1"
  284. // The example to edit a PAD:
  285. // "-E * --lookup-peer-id Mike --auth-method Certificate"
  286. //
  287. // PAD ID
  288. //
  289. { L"--peer-id", 0, 0, BIT(0), BIT(4) },
  290. { L"--peer-address", 0, 0, BIT(0), BIT(5) },
  291. { L"--auth-proto", 0, 0, BIT(0), 0 },
  292. { L"--auth-method", 0, 0, BIT(0), 0 },
  293. { L"--IKE-ID", 0, 0, BIT(0), BIT(6) },
  294. { L"--IKE-ID-", 0, 0, BIT(0), BIT(7) },
  295. { L"--auth-data", 0, 0, BIT(0), 0 },
  296. { L"--revocation-data", 0, 0, BIT(0), 0 },
  297. { L"--lookup-peer-id", 0, 0, BIT(0), BIT(4) },
  298. { L"--lookup-peer-address",0, 0, BIT(0), BIT(5) },
  299. { NULL, 0, 0, 0, 0 },
  300. };
  301. /**
  302. The function to allocate the proper sized buffer for various
  303. EFI interfaces.
  304. @param[in, out] Status Current status.
  305. @param[in, out] Buffer Current allocated buffer, or NULL.
  306. @param[in] BufferSize Current buffer size needed
  307. @retval TRUE If the buffer was reallocated and the caller should try the API again.
  308. @retval FALSE If the buffer was not reallocated successfully.
  309. **/
  310. BOOLEAN
  311. GrowBuffer (
  312. IN OUT EFI_STATUS *Status,
  313. IN OUT VOID **Buffer,
  314. IN UINTN BufferSize
  315. )
  316. {
  317. BOOLEAN TryAgain;
  318. ASSERT (Status != NULL);
  319. ASSERT (Buffer != NULL);
  320. //
  321. // If this is an initial request, buffer will be null with a new buffer size.
  322. //
  323. if ((NULL == *Buffer) && (BufferSize != 0)) {
  324. *Status = EFI_BUFFER_TOO_SMALL;
  325. }
  326. //
  327. // If the status code is "buffer too small", resize the buffer.
  328. //
  329. TryAgain = FALSE;
  330. if (*Status == EFI_BUFFER_TOO_SMALL) {
  331. if (*Buffer != NULL) {
  332. FreePool (*Buffer);
  333. }
  334. *Buffer = AllocateZeroPool (BufferSize);
  335. if (*Buffer != NULL) {
  336. TryAgain = TRUE;
  337. } else {
  338. *Status = EFI_OUT_OF_RESOURCES;
  339. }
  340. }
  341. //
  342. // If there's an error, free the buffer.
  343. //
  344. if (!TryAgain && EFI_ERROR (*Status) && (*Buffer != NULL)) {
  345. FreePool (*Buffer);
  346. *Buffer = NULL;
  347. }
  348. return TryAgain;
  349. }
  350. /**
  351. Function returns an array of handles that support the requested protocol
  352. in a buffer allocated from a pool.
  353. @param[in] SearchType Specifies which handle(s) are to be returned.
  354. @param[in] Protocol Provides the protocol to search by.
  355. This parameter is only valid for SearchType ByProtocol.
  356. @param[in] SearchKey Supplies the search key depending on the SearchType.
  357. @param[in, out] NoHandles The number of handles returned in Buffer.
  358. @param[out] Buffer A pointer to the buffer to return the requested array of
  359. handles that support Protocol.
  360. @retval EFI_SUCCESS The resulting array of handles was returned.
  361. @retval Others Other mistake case.
  362. **/
  363. EFI_STATUS
  364. LocateHandle (
  365. IN EFI_LOCATE_SEARCH_TYPE SearchType,
  366. IN EFI_GUID *Protocol OPTIONAL,
  367. IN VOID *SearchKey OPTIONAL,
  368. IN OUT UINTN *NoHandles,
  369. OUT EFI_HANDLE **Buffer
  370. )
  371. {
  372. EFI_STATUS Status;
  373. UINTN BufferSize;
  374. ASSERT (NoHandles != NULL);
  375. ASSERT (Buffer != NULL);
  376. //
  377. // Initialize for GrowBuffer loop.
  378. //
  379. Status = EFI_SUCCESS;
  380. *Buffer = NULL;
  381. BufferSize = 50 * sizeof (EFI_HANDLE);
  382. //
  383. // Call the real function.
  384. //
  385. while (GrowBuffer (&Status, (VOID **) Buffer, BufferSize)) {
  386. Status = gBS->LocateHandle (
  387. SearchType,
  388. Protocol,
  389. SearchKey,
  390. &BufferSize,
  391. *Buffer
  392. );
  393. }
  394. *NoHandles = BufferSize / sizeof (EFI_HANDLE);
  395. if (EFI_ERROR (Status)) {
  396. *NoHandles = 0;
  397. }
  398. return Status;
  399. }
  400. /**
  401. Find the first instance of this protocol in the system and return its interface.
  402. @param[in] ProtocolGuid The guid of the protocol.
  403. @param[out] Interface The pointer to the first instance of the protocol.
  404. @retval EFI_SUCCESS A protocol instance matching ProtocolGuid was found.
  405. @retval Others A protocol instance matching ProtocolGuid was not found.
  406. **/
  407. EFI_STATUS
  408. LocateProtocol (
  409. IN EFI_GUID *ProtocolGuid,
  410. OUT VOID **Interface
  411. )
  412. {
  413. EFI_STATUS Status;
  414. UINTN NumberHandles;
  415. UINTN Index;
  416. EFI_HANDLE *Handles;
  417. *Interface = NULL;
  418. Handles = NULL;
  419. NumberHandles = 0;
  420. Status = LocateHandle (ByProtocol, ProtocolGuid, NULL, &NumberHandles, &Handles);
  421. if (EFI_ERROR (Status)) {
  422. DEBUG ((EFI_D_INFO, "LibLocateProtocol: Handle not found\n"));
  423. return Status;
  424. }
  425. for (Index = 0; Index < NumberHandles; Index++) {
  426. ASSERT (Handles != NULL);
  427. Status = gBS->HandleProtocol (
  428. Handles[Index],
  429. ProtocolGuid,
  430. Interface
  431. );
  432. if (!EFI_ERROR (Status)) {
  433. break;
  434. }
  435. }
  436. if (Handles != NULL) {
  437. FreePool (Handles);
  438. }
  439. return Status;
  440. }
  441. /**
  442. Helper function called to check the conflicted flags.
  443. @param[in] CheckList The pointer to the VAR_CHECK_ITEM table.
  444. @param[in] ParamPackage The pointer to the ParamPackage list.
  445. @retval EFI_SUCCESS No conflicted flags.
  446. @retval EFI_INVALID_PARAMETER The input parameter is erroroneous or there are some conflicted flags.
  447. **/
  448. EFI_STATUS
  449. IpSecConfigRetriveCheckListByName (
  450. IN VAR_CHECK_ITEM *CheckList,
  451. IN LIST_ENTRY *ParamPackage
  452. )
  453. {
  454. LIST_ENTRY *Node;
  455. VAR_CHECK_ITEM *Item;
  456. UINT32 Attribute1;
  457. UINT32 Attribute2;
  458. UINT32 Attribute3;
  459. UINT32 Attribute4;
  460. UINT32 Index;
  461. Attribute1 = 0;
  462. Attribute2 = 0;
  463. Attribute3 = 0;
  464. Attribute4 = 0;
  465. Index = 0;
  466. Item = mIpSecConfigVarCheckList;
  467. if ((ParamPackage == NULL) || (CheckList == NULL)) {
  468. return EFI_INVALID_PARAMETER;
  469. }
  470. //
  471. // Enumerate through the list of parameters that are input by user.
  472. //
  473. for (Node = GetFirstNode (ParamPackage); !IsNull (ParamPackage, Node); Node = GetNextNode (ParamPackage, Node)) {
  474. if (((SHELL_PARAM_PACKAGE *) Node)->Name != NULL) {
  475. //
  476. // Enumerate the check list that defines the conflicted attributes of each flag.
  477. //
  478. for (; Item->VarName != NULL; Item++) {
  479. if (StrCmp (((SHELL_PARAM_PACKAGE *) Node)->Name, Item->VarName) == 0) {
  480. Index++;
  481. if (Index == 1) {
  482. Attribute1 = Item->Attribute1;
  483. Attribute2 = Item->Attribute2;
  484. Attribute3 = Item->Attribute3;
  485. Attribute4 = Item->Attribute4;
  486. } else {
  487. Attribute1 &= Item->Attribute1;
  488. Attribute2 |= Item->Attribute2;
  489. Attribute3 &= Item->Attribute3;
  490. Attribute4 |= Item->Attribute4;
  491. if (Attribute1 != 0) {
  492. return EFI_INVALID_PARAMETER;
  493. }
  494. if (Attribute2 != 0) {
  495. if ((Index == 2) && (StrCmp (Item->VarName, L"-p") == 0)) {
  496. continue;
  497. }
  498. return EFI_INVALID_PARAMETER;
  499. }
  500. if (Attribute3 == 0) {
  501. return EFI_INVALID_PARAMETER;
  502. }
  503. if (((Attribute4 & 0xFF) == 0x03) || ((Attribute4 & 0xFF) == 0x0C) ||
  504. ((Attribute4 & 0xFF) == 0x30) || ((Attribute4 & 0xFF) == 0xC0)) {
  505. return EFI_INVALID_PARAMETER;
  506. }
  507. }
  508. break;
  509. }
  510. }
  511. Item = mIpSecConfigVarCheckList;
  512. }
  513. }
  514. return EFI_SUCCESS;
  515. }
  516. /**
  517. This is the declaration of an EFI image entry point. This entry point is
  518. the same for UEFI Applications, UEFI OS Loaders, and UEFI Drivers, including
  519. both device drivers and bus drivers.
  520. The entry point for IpSecConfig application that parse the command line input and call an IpSecConfig process.
  521. @param[in] ImageHandle The image handle of this application.
  522. @param[in] SystemTable The pointer to the EFI System Table.
  523. @retval EFI_SUCCESS The operation completed successfully.
  524. **/
  525. EFI_STATUS
  526. EFIAPI
  527. InitializeIpSecConfig (
  528. IN EFI_HANDLE ImageHandle,
  529. IN EFI_SYSTEM_TABLE *SystemTable
  530. )
  531. {
  532. EFI_STATUS Status;
  533. EFI_IPSEC_CONFIG_DATA_TYPE DataType;
  534. UINT8 Value;
  535. LIST_ENTRY *ParamPackage;
  536. CONST CHAR16 *ValueStr;
  537. CHAR16 *ProblemParam;
  538. UINTN NonOptionCount;
  539. EFI_HII_PACKAGE_LIST_HEADER *PackageList;
  540. //
  541. // Retrieve HII package list from ImageHandle
  542. //
  543. Status = gBS->OpenProtocol (
  544. ImageHandle,
  545. &gEfiHiiPackageListProtocolGuid,
  546. (VOID **) &PackageList,
  547. ImageHandle,
  548. NULL,
  549. EFI_OPEN_PROTOCOL_GET_PROTOCOL
  550. );
  551. if (EFI_ERROR (Status)) {
  552. return Status;
  553. }
  554. //
  555. // Publish HII package list to HII Database.
  556. //
  557. Status = gHiiDatabase->NewPackageList (
  558. gHiiDatabase,
  559. PackageList,
  560. NULL,
  561. &mHiiHandle
  562. );
  563. if (EFI_ERROR (Status)) {
  564. return Status;
  565. }
  566. ASSERT (mHiiHandle != NULL);
  567. Status = ShellCommandLineParseEx (mIpSecConfigParamList, &ParamPackage, &ProblemParam, TRUE, FALSE);
  568. if (EFI_ERROR (Status)) {
  569. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_UNKNOWN_OPERATION), mHiiHandle, ProblemParam);
  570. goto Done;
  571. }
  572. Status = IpSecConfigRetriveCheckListByName (mIpSecConfigVarCheckList, ParamPackage);
  573. if (EFI_ERROR (Status)) {
  574. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_MISTAKEN_OPTIONS), mHiiHandle);
  575. goto Done;
  576. }
  577. Status = LocateProtocol (&gEfiIpSecConfigProtocolGuid, (VOID **) &mIpSecConfig);
  578. if (EFI_ERROR (Status) || mIpSecConfig == NULL) {
  579. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_PROTOCOL_INEXISTENT), mHiiHandle, mAppName);
  580. goto Done;
  581. }
  582. Status = LocateProtocol (&gEfiIpSec2ProtocolGuid, (VOID **) &mIpSec);
  583. if (EFI_ERROR (Status) || mIpSec == NULL) {
  584. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_PROTOCOL_INEXISTENT), mHiiHandle, mAppName);
  585. goto Done;
  586. }
  587. //
  588. // Enable IPsec.
  589. //
  590. if (ShellCommandLineGetFlag (ParamPackage, L"-enable")) {
  591. if (!(mIpSec->DisabledFlag)) {
  592. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_ALREADY_ENABLE), mHiiHandle, mAppName);
  593. } else {
  594. //
  595. // Set enable flag.
  596. //
  597. Value = IPSEC_STATUS_ENABLED;
  598. Status = gRT->SetVariable (
  599. IPSECCONFIG_STATUS_NAME,
  600. &gEfiIpSecConfigProtocolGuid,
  601. EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_NON_VOLATILE,
  602. sizeof (Value),
  603. &Value
  604. );
  605. if (!EFI_ERROR (Status)) {
  606. mIpSec->DisabledFlag = FALSE;
  607. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_ENABLE_SUCCESS), mHiiHandle, mAppName);
  608. } else {
  609. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_ENABLE_FAILED), mHiiHandle, mAppName);
  610. }
  611. }
  612. goto Done;
  613. }
  614. //
  615. // Disable IPsec.
  616. //
  617. if (ShellCommandLineGetFlag (ParamPackage, L"-disable")) {
  618. if (mIpSec->DisabledFlag) {
  619. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_ALREADY_DISABLE), mHiiHandle, mAppName);
  620. } else {
  621. //
  622. // Set disable flag; however, leave it to be disabled in the callback function of DisabledEvent.
  623. //
  624. gBS->SignalEvent (mIpSec->DisabledEvent);
  625. if (mIpSec->DisabledFlag) {
  626. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_DISABLE_SUCCESS), mHiiHandle, mAppName);
  627. } else {
  628. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_DISABLE_FAILED), mHiiHandle, mAppName);
  629. }
  630. }
  631. goto Done;
  632. }
  633. //
  634. //IPsec Status.
  635. //
  636. if (ShellCommandLineGetFlag (ParamPackage, L"-status")) {
  637. if (mIpSec->DisabledFlag) {
  638. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_STATUS_DISABLE), mHiiHandle, mAppName);
  639. } else {
  640. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_STATUS_ENABLE), mHiiHandle, mAppName);
  641. }
  642. goto Done;
  643. }
  644. //
  645. // Try to get policy database type.
  646. //
  647. DataType = (EFI_IPSEC_CONFIG_DATA_TYPE) - 1;
  648. ValueStr = ShellCommandLineGetValue (ParamPackage, L"-p");
  649. if (ValueStr != NULL) {
  650. DataType = (EFI_IPSEC_CONFIG_DATA_TYPE) MapStringToInteger (ValueStr, mMapPolicy);
  651. if (DataType == -1) {
  652. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_INCORRECT_DB), mHiiHandle, mAppName, ValueStr);
  653. goto Done;
  654. }
  655. }
  656. NonOptionCount = ShellCommandLineGetCount (ParamPackage);
  657. if ((NonOptionCount - 1) > 0) {
  658. ValueStr = ShellCommandLineGetRawValue (ParamPackage, (UINT32) (NonOptionCount - 1));
  659. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_REDUNDANCY_MANY), mHiiHandle, mAppName, ValueStr);
  660. goto Done;
  661. }
  662. if (DataType == -1) {
  663. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_DB), mHiiHandle, mAppName);
  664. goto Done;
  665. }
  666. if (ShellCommandLineGetFlag (ParamPackage, L"-a")) {
  667. Status = AddOrInsertPolicyEntry (DataType, ParamPackage);
  668. if (EFI_ERROR (Status)) {
  669. goto Done;
  670. }
  671. } else if (ShellCommandLineGetFlag (ParamPackage, L"-i")) {
  672. Status = AddOrInsertPolicyEntry (DataType, ParamPackage);
  673. if (EFI_ERROR (Status)) {
  674. goto Done;
  675. }
  676. } else if (ShellCommandLineGetFlag (ParamPackage, L"-e")) {
  677. Status = EditPolicyEntry (DataType, ParamPackage);
  678. if (EFI_ERROR (Status)) {
  679. goto Done;
  680. }
  681. } else if (ShellCommandLineGetFlag (ParamPackage, L"-d")) {
  682. Status = FlushOrDeletePolicyEntry (DataType, ParamPackage);
  683. if (EFI_ERROR (Status)) {
  684. goto Done;
  685. }
  686. } else if (ShellCommandLineGetFlag (ParamPackage, L"-f")) {
  687. Status = FlushOrDeletePolicyEntry (DataType, ParamPackage);
  688. if (EFI_ERROR (Status)) {
  689. goto Done;
  690. }
  691. } else if (ShellCommandLineGetFlag (ParamPackage, L"-l")) {
  692. Status = ListPolicyEntry (DataType, ParamPackage);
  693. if (EFI_ERROR (Status)) {
  694. goto Done;
  695. }
  696. } else {
  697. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_UNKNOWN_OPERATION), mHiiHandle, mAppName);
  698. goto Done;
  699. }
  700. Done:
  701. ShellCommandLineFreeVarList (ParamPackage);
  702. HiiRemovePackages (mHiiHandle);
  703. return EFI_SUCCESS;
  704. }