PolicyEntryOperation.c 64 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070
  1. /** @file
  2. The implementation of policy entry operation function in IpSecConfig application.
  3. Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
  4. SPDX-License-Identifier: BSD-2-Clause-Patent
  5. **/
  6. #include "IpSecConfig.h"
  7. #include "Indexer.h"
  8. #include "Match.h"
  9. #include "Helper.h"
  10. #include "ForEach.h"
  11. #include "PolicyEntryOperation.h"
  12. /**
  13. Fill in EFI_IPSEC_SPD_SELECTOR through ParamPackage list.
  14. @param[out] Selector The pointer to the EFI_IPSEC_SPD_SELECTOR structure.
  15. @param[in] ParamPackage The pointer to the ParamPackage list.
  16. @param[in, out] Mask The pointer to the Mask.
  17. @retval EFI_SUCCESS Fill in EFI_IPSEC_SPD_SELECTOR successfully.
  18. @retval EFI_INVALID_PARAMETER Invalid user input parameter.
  19. **/
  20. EFI_STATUS
  21. CreateSpdSelector (
  22. OUT EFI_IPSEC_SPD_SELECTOR *Selector,
  23. IN LIST_ENTRY *ParamPackage,
  24. IN OUT UINT32 *Mask
  25. )
  26. {
  27. EFI_STATUS Status;
  28. EFI_STATUS ReturnStatus;
  29. CONST CHAR16 *ValueStr;
  30. Status = EFI_SUCCESS;
  31. ReturnStatus = EFI_SUCCESS;
  32. //
  33. // Convert user imput from string to integer, and fill in the member in EFI_IPSEC_SPD_SELECTOR.
  34. //
  35. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--local");
  36. if (ValueStr != NULL) {
  37. Selector->LocalAddressCount = 1;
  38. Status = EfiInetAddrRange ((CHAR16 *) ValueStr, Selector->LocalAddress);
  39. if (EFI_ERROR (Status)) {
  40. ShellPrintHiiEx (
  41. -1,
  42. -1,
  43. NULL,
  44. STRING_TOKEN (STR_IPSEC_CONFIG_INCORRECT_PARAMETER_VALUE),
  45. mHiiHandle,
  46. mAppName,
  47. L"--local",
  48. ValueStr
  49. );
  50. ReturnStatus = EFI_INVALID_PARAMETER;
  51. } else {
  52. *Mask |= LOCAL;
  53. }
  54. }
  55. //
  56. // Convert user imput from string to integer, and fill in the member in EFI_IPSEC_SPD_SELECTOR.
  57. //
  58. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--remote");
  59. if (ValueStr != NULL) {
  60. Selector->RemoteAddressCount = 1;
  61. Status = EfiInetAddrRange ((CHAR16 *) ValueStr, Selector->RemoteAddress);
  62. if (EFI_ERROR (Status)) {
  63. ShellPrintHiiEx (
  64. -1,
  65. -1,
  66. NULL,
  67. STRING_TOKEN (STR_IPSEC_CONFIG_INCORRECT_PARAMETER_VALUE),
  68. mHiiHandle,
  69. mAppName,
  70. L"--remote",
  71. ValueStr
  72. );
  73. ReturnStatus = EFI_INVALID_PARAMETER;
  74. } else {
  75. *Mask |= REMOTE;
  76. }
  77. }
  78. Selector->NextLayerProtocol = EFI_IPSEC_ANY_PROTOCOL;
  79. //
  80. // Convert user imput from string to integer, and fill in the member in EFI_IPSEC_SPD_SELECTOR.
  81. //
  82. Status = GetNumber (
  83. L"--proto",
  84. (UINT16) -1,
  85. &Selector->NextLayerProtocol,
  86. sizeof (UINT16),
  87. mMapIpProtocol,
  88. ParamPackage,
  89. FORMAT_NUMBER | FORMAT_STRING
  90. );
  91. if (!EFI_ERROR (Status)) {
  92. *Mask |= PROTO;
  93. }
  94. if (Status == EFI_INVALID_PARAMETER) {
  95. ReturnStatus = EFI_INVALID_PARAMETER;
  96. }
  97. Selector->LocalPort = EFI_IPSEC_ANY_PORT;
  98. Selector->RemotePort = EFI_IPSEC_ANY_PORT;
  99. //
  100. // Convert user imput from string to integer, and fill in the member in EFI_IPSEC_SPD_SELECTOR.
  101. //
  102. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--local-port");
  103. if (ValueStr != NULL) {
  104. Status = EfiInetPortRange ((CHAR16 *) ValueStr, &Selector->LocalPort, &Selector->LocalPortRange);
  105. if (EFI_ERROR (Status)) {
  106. ShellPrintHiiEx (
  107. -1,
  108. -1,
  109. NULL,
  110. STRING_TOKEN (STR_IPSEC_CONFIG_INCORRECT_PARAMETER_VALUE),
  111. mHiiHandle,
  112. mAppName,
  113. L"--local-port",
  114. ValueStr
  115. );
  116. ReturnStatus = EFI_INVALID_PARAMETER;
  117. } else {
  118. *Mask |= LOCAL_PORT;
  119. }
  120. }
  121. //
  122. // Convert user imput from string to integer, and fill in the member in EFI_IPSEC_SPD_SELECTOR.
  123. //
  124. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--remote-port");
  125. if (ValueStr != NULL) {
  126. Status = EfiInetPortRange ((CHAR16 *) ValueStr, &Selector->RemotePort, &Selector->RemotePortRange);
  127. if (EFI_ERROR (Status)) {
  128. ShellPrintHiiEx (
  129. -1,
  130. -1,
  131. NULL,
  132. STRING_TOKEN (STR_IPSEC_CONFIG_INCORRECT_PARAMETER_VALUE),
  133. mHiiHandle,
  134. mAppName,
  135. L"--remote-port",
  136. ValueStr
  137. );
  138. ReturnStatus = EFI_INVALID_PARAMETER;
  139. } else {
  140. *Mask |= REMOTE_PORT;
  141. }
  142. }
  143. //
  144. // Convert user imput from string to integer, and fill in the member in EFI_IPSEC_SPD_SELECTOR.
  145. //
  146. Status = GetNumber (
  147. L"--icmp-type",
  148. (UINT8) -1,
  149. &Selector->LocalPort,
  150. sizeof (UINT16),
  151. NULL,
  152. ParamPackage,
  153. FORMAT_NUMBER
  154. );
  155. if (!EFI_ERROR (Status)) {
  156. *Mask |= ICMP_TYPE;
  157. }
  158. if (Status == EFI_INVALID_PARAMETER) {
  159. ReturnStatus = EFI_INVALID_PARAMETER;
  160. }
  161. //
  162. // Convert user imput from string to integer, and fill in the member in EFI_IPSEC_SPD_SELECTOR.
  163. //
  164. Status = GetNumber (
  165. L"--icmp-code",
  166. (UINT8) -1,
  167. &Selector->RemotePort,
  168. sizeof (UINT16),
  169. NULL,
  170. ParamPackage,
  171. FORMAT_NUMBER
  172. );
  173. if (!EFI_ERROR (Status)) {
  174. *Mask |= ICMP_CODE;
  175. }
  176. if (Status == EFI_INVALID_PARAMETER) {
  177. ReturnStatus = EFI_INVALID_PARAMETER;
  178. }
  179. return ReturnStatus;
  180. }
  181. /**
  182. Fill in EFI_IPSEC_SPD_SELECTOR and EFI_IPSEC_SPD_DATA through ParamPackage list.
  183. @param[out] Selector The pointer to the EFI_IPSEC_SPD_SELECTOR structure.
  184. @param[out] Data The pointer to the EFI_IPSEC_SPD_DATA structure.
  185. @param[in] ParamPackage The pointer to the ParamPackage list.
  186. @param[out] Mask The pointer to the Mask.
  187. @param[in] CreateNew The switch to create new.
  188. @retval EFI_SUCCESS Fill in EFI_IPSEC_SPD_SELECTOR and EFI_IPSEC_SPD_DATA successfully.
  189. @retval EFI_INVALID_PARAMETER Invalid user input parameter.
  190. **/
  191. EFI_STATUS
  192. CreateSpdEntry (
  193. OUT EFI_IPSEC_SPD_SELECTOR **Selector,
  194. OUT EFI_IPSEC_SPD_DATA **Data,
  195. IN LIST_ENTRY *ParamPackage,
  196. OUT UINT32 *Mask,
  197. IN BOOLEAN CreateNew
  198. )
  199. {
  200. EFI_STATUS Status;
  201. EFI_STATUS ReturnStatus;
  202. CONST CHAR16 *ValueStr;
  203. UINTN DataSize;
  204. Status = EFI_SUCCESS;
  205. *Mask = 0;
  206. *Selector = AllocateZeroPool (sizeof (EFI_IPSEC_SPD_SELECTOR) + 2 * sizeof (EFI_IP_ADDRESS_INFO));
  207. ASSERT (*Selector != NULL);
  208. (*Selector)->LocalAddress = (EFI_IP_ADDRESS_INFO *) (*Selector + 1);
  209. (*Selector)->RemoteAddress = (*Selector)->LocalAddress + 1;
  210. ReturnStatus = CreateSpdSelector (*Selector, ParamPackage, Mask);
  211. //
  212. // SPD DATA
  213. // NOTE: Allocate enough memory and add padding for different arch.
  214. //
  215. DataSize = ALIGN_VARIABLE (sizeof (EFI_IPSEC_SPD_DATA));
  216. DataSize = ALIGN_VARIABLE (DataSize + sizeof (EFI_IPSEC_PROCESS_POLICY));
  217. DataSize += sizeof (EFI_IPSEC_TUNNEL_OPTION);
  218. *Data = AllocateZeroPool (DataSize);
  219. ASSERT (*Data != NULL);
  220. (*Data)->ProcessingPolicy = (EFI_IPSEC_PROCESS_POLICY *) ALIGN_POINTER (
  221. (*Data + 1),
  222. sizeof (UINTN)
  223. );
  224. (*Data)->ProcessingPolicy->TunnelOption = (EFI_IPSEC_TUNNEL_OPTION *) ALIGN_POINTER (
  225. ((*Data)->ProcessingPolicy + 1),
  226. sizeof (UINTN)
  227. );
  228. //
  229. // Convert user imput from string to integer, and fill in the Name in EFI_IPSEC_SPD_DATA.
  230. //
  231. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--name");
  232. if (ValueStr != NULL) {
  233. UnicodeStrToAsciiStrS (ValueStr, (CHAR8 *) (*Data)->Name, sizeof ((*Data)->Name));
  234. *Mask |= NAME;
  235. }
  236. //
  237. // Convert user imput from string to integer, and fill in the PackageFlag in EFI_IPSEC_SPD_DATA.
  238. //
  239. Status = GetNumber (
  240. L"--packet-flag",
  241. (UINT8) -1,
  242. &(*Data)->PackageFlag,
  243. sizeof (UINT32),
  244. NULL,
  245. ParamPackage,
  246. FORMAT_NUMBER
  247. );
  248. if (!EFI_ERROR (Status)) {
  249. *Mask |= PACKET_FLAG;
  250. }
  251. if (Status == EFI_INVALID_PARAMETER) {
  252. ReturnStatus = EFI_INVALID_PARAMETER;
  253. }
  254. //
  255. // Convert user imput from string to integer, and fill in the Action in EFI_IPSEC_SPD_DATA.
  256. //
  257. Status = GetNumber (
  258. L"--action",
  259. (UINT8) -1,
  260. &(*Data)->Action,
  261. sizeof (UINT32),
  262. mMapIpSecAction,
  263. ParamPackage,
  264. FORMAT_STRING
  265. );
  266. if (!EFI_ERROR (Status)) {
  267. *Mask |= ACTION;
  268. }
  269. if (Status == EFI_INVALID_PARAMETER) {
  270. ReturnStatus = EFI_INVALID_PARAMETER;
  271. }
  272. //
  273. // Convert user imput from string to integer, and fill in the ExtSeqNum in EFI_IPSEC_SPD_DATA.
  274. //
  275. if (ShellCommandLineGetFlag (ParamPackage, L"--ext-sequence")) {
  276. (*Data)->ProcessingPolicy->ExtSeqNum = TRUE;
  277. *Mask |= EXT_SEQUENCE;
  278. } else if (ShellCommandLineGetFlag (ParamPackage, L"--ext-sequence-")) {
  279. (*Data)->ProcessingPolicy->ExtSeqNum = FALSE;
  280. *Mask |= EXT_SEQUENCE;
  281. }
  282. //
  283. // Convert user imput from string to integer, and fill in the SeqOverflow in EFI_IPSEC_SPD_DATA.
  284. //
  285. if (ShellCommandLineGetFlag (ParamPackage, L"--sequence-overflow")) {
  286. (*Data)->ProcessingPolicy->SeqOverflow = TRUE;
  287. *Mask |= SEQUENCE_OVERFLOW;
  288. } else if (ShellCommandLineGetFlag (ParamPackage, L"--sequence-overflow-")) {
  289. (*Data)->ProcessingPolicy->SeqOverflow = FALSE;
  290. *Mask |= SEQUENCE_OVERFLOW;
  291. }
  292. //
  293. // Convert user imput from string to integer, and fill in the FragCheck in EFI_IPSEC_SPD_DATA.
  294. //
  295. if (ShellCommandLineGetFlag (ParamPackage, L"--fragment-check")) {
  296. (*Data)->ProcessingPolicy->FragCheck = TRUE;
  297. *Mask |= FRAGMENT_CHECK;
  298. } else if (ShellCommandLineGetFlag (ParamPackage, L"--fragment-check-")) {
  299. (*Data)->ProcessingPolicy->FragCheck = FALSE;
  300. *Mask |= FRAGMENT_CHECK;
  301. }
  302. //
  303. // Convert user imput from string to integer, and fill in the ProcessingPolicy in EFI_IPSEC_SPD_DATA.
  304. //
  305. Status = GetNumber (
  306. L"--lifebyte",
  307. (UINT64) -1,
  308. &(*Data)->ProcessingPolicy->SaLifetime.ByteCount,
  309. sizeof (UINT64),
  310. NULL,
  311. ParamPackage,
  312. FORMAT_NUMBER
  313. );
  314. if (!EFI_ERROR (Status)) {
  315. *Mask |= LIFEBYTE;
  316. }
  317. if (Status == EFI_INVALID_PARAMETER) {
  318. ReturnStatus = EFI_INVALID_PARAMETER;
  319. }
  320. Status = GetNumber (
  321. L"--lifetime",
  322. (UINT64) -1,
  323. &(*Data)->ProcessingPolicy->SaLifetime.HardLifetime,
  324. sizeof (UINT64),
  325. NULL,
  326. ParamPackage,
  327. FORMAT_NUMBER
  328. );
  329. if (!EFI_ERROR (Status)) {
  330. *Mask |= LIFETIME;
  331. }
  332. if (Status == EFI_INVALID_PARAMETER) {
  333. ReturnStatus = EFI_INVALID_PARAMETER;
  334. }
  335. Status = GetNumber (
  336. L"--lifetime-soft",
  337. (UINT64) -1,
  338. &(*Data)->ProcessingPolicy->SaLifetime.SoftLifetime,
  339. sizeof (UINT64),
  340. NULL,
  341. ParamPackage,
  342. FORMAT_NUMBER
  343. );
  344. if (!EFI_ERROR (Status)) {
  345. *Mask |= LIFETIME_SOFT;
  346. }
  347. if (Status == EFI_INVALID_PARAMETER) {
  348. ReturnStatus = EFI_INVALID_PARAMETER;
  349. }
  350. (*Data)->ProcessingPolicy->Mode = EfiIPsecTransport;
  351. Status = GetNumber (
  352. L"--mode",
  353. 0,
  354. &(*Data)->ProcessingPolicy->Mode,
  355. sizeof (UINT32),
  356. mMapIpSecMode,
  357. ParamPackage,
  358. FORMAT_STRING
  359. );
  360. if (!EFI_ERROR (Status)) {
  361. *Mask |= MODE;
  362. }
  363. if (Status == EFI_INVALID_PARAMETER) {
  364. ReturnStatus = EFI_INVALID_PARAMETER;
  365. }
  366. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--tunnel-local");
  367. if (ValueStr != NULL) {
  368. Status = EfiInetAddr2 ((CHAR16 *) ValueStr, &(*Data)->ProcessingPolicy->TunnelOption->LocalTunnelAddress);
  369. if (EFI_ERROR (Status)) {
  370. ShellPrintHiiEx (
  371. -1,
  372. -1,
  373. NULL,
  374. STRING_TOKEN (STR_IPSEC_CONFIG_INCORRECT_PARAMETER_VALUE),
  375. mHiiHandle,
  376. mAppName,
  377. L"--tunnel-local",
  378. ValueStr
  379. );
  380. ReturnStatus = EFI_INVALID_PARAMETER;
  381. } else {
  382. *Mask |= TUNNEL_LOCAL;
  383. }
  384. }
  385. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--tunnel-remote");
  386. if (ValueStr != NULL) {
  387. Status = EfiInetAddr2 ((CHAR16 *) ValueStr, &(*Data)->ProcessingPolicy->TunnelOption->RemoteTunnelAddress);
  388. if (EFI_ERROR (Status)) {
  389. ShellPrintHiiEx (
  390. -1,
  391. -1,
  392. NULL,
  393. STRING_TOKEN (STR_IPSEC_CONFIG_INCORRECT_PARAMETER_VALUE),
  394. mHiiHandle,
  395. mAppName,
  396. L"--tunnel-remote",
  397. ValueStr
  398. );
  399. ReturnStatus = EFI_INVALID_PARAMETER;
  400. } else {
  401. *Mask |= TUNNEL_REMOTE;
  402. }
  403. }
  404. (*Data)->ProcessingPolicy->TunnelOption->DF = EfiIPsecTunnelCopyDf;
  405. Status = GetNumber (
  406. L"--dont-fragment",
  407. 0,
  408. &(*Data)->ProcessingPolicy->TunnelOption->DF,
  409. sizeof (UINT32),
  410. mMapDfOption,
  411. ParamPackage,
  412. FORMAT_STRING
  413. );
  414. if (!EFI_ERROR (Status)) {
  415. *Mask |= DONT_FRAGMENT;
  416. }
  417. if (Status == EFI_INVALID_PARAMETER) {
  418. ReturnStatus = EFI_INVALID_PARAMETER;
  419. }
  420. (*Data)->ProcessingPolicy->Proto = EfiIPsecESP;
  421. Status = GetNumber (
  422. L"--ipsec-proto",
  423. 0,
  424. &(*Data)->ProcessingPolicy->Proto,
  425. sizeof (UINT32),
  426. mMapIpSecProtocol,
  427. ParamPackage,
  428. FORMAT_STRING
  429. );
  430. if (!EFI_ERROR (Status)) {
  431. *Mask |= IPSEC_PROTO;
  432. }
  433. if (Status == EFI_INVALID_PARAMETER) {
  434. ReturnStatus = EFI_INVALID_PARAMETER;
  435. }
  436. Status = GetNumber (
  437. L"--encrypt-algo",
  438. 0,
  439. &(*Data)->ProcessingPolicy->EncAlgoId,
  440. sizeof (UINT8),
  441. mMapEncAlgo,
  442. ParamPackage,
  443. FORMAT_STRING
  444. );
  445. if (!EFI_ERROR (Status)) {
  446. *Mask |= ENCRYPT_ALGO;
  447. }
  448. if (Status == EFI_INVALID_PARAMETER) {
  449. ReturnStatus = EFI_INVALID_PARAMETER;
  450. }
  451. Status = GetNumber (
  452. L"--auth-algo",
  453. 0,
  454. &(*Data)->ProcessingPolicy->AuthAlgoId,
  455. sizeof (UINT8),
  456. mMapAuthAlgo,
  457. ParamPackage,
  458. FORMAT_STRING
  459. );
  460. if (!EFI_ERROR (Status)) {
  461. *Mask |= AUTH_ALGO;
  462. }
  463. if (Status == EFI_INVALID_PARAMETER) {
  464. ReturnStatus = EFI_INVALID_PARAMETER;
  465. }
  466. //
  467. // Cannot check Mode against EfiIPsecTunnel, because user may want to change tunnel_remote only so the Mode is not set.
  468. //
  469. if ((*Mask & (TUNNEL_LOCAL | TUNNEL_REMOTE | DONT_FRAGMENT)) == 0) {
  470. (*Data)->ProcessingPolicy->TunnelOption = NULL;
  471. }
  472. if ((*Mask & (EXT_SEQUENCE | SEQUENCE_OVERFLOW | FRAGMENT_CHECK | LIFEBYTE |
  473. LIFETIME_SOFT | LIFETIME | MODE | TUNNEL_LOCAL | TUNNEL_REMOTE |
  474. DONT_FRAGMENT | IPSEC_PROTO | AUTH_ALGO | ENCRYPT_ALGO)) == 0) {
  475. if ((*Data)->Action != EfiIPsecActionProtect) {
  476. //
  477. // User may not provide additional parameter for Protect action, so we cannot simply set ProcessingPolicy to NULL.
  478. //
  479. (*Data)->ProcessingPolicy = NULL;
  480. }
  481. }
  482. if (CreateNew) {
  483. if ((*Mask & (LOCAL | REMOTE | PROTO | ACTION)) != (LOCAL | REMOTE | PROTO | ACTION)) {
  484. ShellPrintHiiEx (
  485. -1,
  486. -1,
  487. NULL,
  488. STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_ONE_OF_PARAMETERS),
  489. mHiiHandle,
  490. mAppName,
  491. L"--local --remote --proto --action"
  492. );
  493. ReturnStatus = EFI_INVALID_PARAMETER;
  494. } else if (((*Data)->Action == EfiIPsecActionProtect) &&
  495. ((*Data)->ProcessingPolicy->Mode == EfiIPsecTunnel) &&
  496. ((*Mask & (TUNNEL_LOCAL | TUNNEL_REMOTE)) != (TUNNEL_LOCAL | TUNNEL_REMOTE))) {
  497. ShellPrintHiiEx (
  498. -1,
  499. -1,
  500. NULL,
  501. STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_ONE_OF_PARAMETERS),
  502. mHiiHandle,
  503. mAppName,
  504. L"--tunnel-local --tunnel-remote"
  505. );
  506. ReturnStatus = EFI_INVALID_PARAMETER;
  507. }
  508. }
  509. return ReturnStatus;
  510. }
  511. /**
  512. Fill in EFI_IPSEC_SA_ID and EFI_IPSEC_SA_DATA2 through ParamPackage list.
  513. @param[out] SaId The pointer to the EFI_IPSEC_SA_ID structure.
  514. @param[out] Data The pointer to the EFI_IPSEC_SA_DATA2 structure.
  515. @param[in] ParamPackage The pointer to the ParamPackage list.
  516. @param[out] Mask The pointer to the Mask.
  517. @param[in] CreateNew The switch to create new.
  518. @retval EFI_SUCCESS Fill in EFI_IPSEC_SA_ID and EFI_IPSEC_SA_DATA2 successfully.
  519. @retval EFI_INVALID_PARAMETER Invalid user input parameter.
  520. **/
  521. EFI_STATUS
  522. CreateSadEntry (
  523. OUT EFI_IPSEC_SA_ID **SaId,
  524. OUT EFI_IPSEC_SA_DATA2 **Data,
  525. IN LIST_ENTRY *ParamPackage,
  526. OUT UINT32 *Mask,
  527. IN BOOLEAN CreateNew
  528. )
  529. {
  530. EFI_STATUS Status;
  531. EFI_STATUS ReturnStatus;
  532. UINTN AuthKeyLength;
  533. UINTN EncKeyLength;
  534. CONST CHAR16 *ValueStr;
  535. CHAR8 *AsciiStr;
  536. UINTN DataSize;
  537. Status = EFI_SUCCESS;
  538. ReturnStatus = EFI_SUCCESS;
  539. *Mask = 0;
  540. AuthKeyLength = 0;
  541. EncKeyLength = 0;
  542. *SaId = AllocateZeroPool (sizeof (EFI_IPSEC_SA_ID));
  543. ASSERT (*SaId != NULL);
  544. //
  545. // Convert user imput from string to integer, and fill in the Spi in EFI_IPSEC_SA_ID.
  546. //
  547. Status = GetNumber (L"--spi", (UINT32) -1, &(*SaId)->Spi, sizeof (UINT32), NULL, ParamPackage, FORMAT_NUMBER);
  548. if (!EFI_ERROR (Status)) {
  549. *Mask |= SPI;
  550. }
  551. if (Status == EFI_INVALID_PARAMETER) {
  552. ReturnStatus = EFI_INVALID_PARAMETER;
  553. }
  554. //
  555. // Convert user imput from string to integer, and fill in the Proto in EFI_IPSEC_SA_ID.
  556. //
  557. Status = GetNumber (
  558. L"--ipsec-proto",
  559. 0,
  560. &(*SaId)->Proto,
  561. sizeof (EFI_IPSEC_PROTOCOL_TYPE),
  562. mMapIpSecProtocol,
  563. ParamPackage,
  564. FORMAT_STRING
  565. );
  566. if (!EFI_ERROR (Status)) {
  567. *Mask |= IPSEC_PROTO;
  568. }
  569. if (Status == EFI_INVALID_PARAMETER) {
  570. ReturnStatus = EFI_INVALID_PARAMETER;
  571. }
  572. //
  573. // Convert user imput from string to integer, and fill in EFI_IPSEC_SA_DATA2.
  574. //
  575. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--auth-key");
  576. if (ValueStr != NULL) {
  577. AuthKeyLength = StrLen (ValueStr);
  578. }
  579. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--encrypt-key");
  580. if (ValueStr != NULL) {
  581. EncKeyLength = StrLen (ValueStr);
  582. }
  583. //
  584. // EFI_IPSEC_SA_DATA2:
  585. // +------------
  586. // | EFI_IPSEC_SA_DATA2
  587. // +-----------------------
  588. // | AuthKey
  589. // +-------------------------
  590. // | EncKey
  591. // +-------------------------
  592. // | SpdSelector
  593. //
  594. // Notes: To make sure the address alignment add padding after each data if needed.
  595. //
  596. DataSize = ALIGN_VARIABLE (sizeof (EFI_IPSEC_SA_DATA2));
  597. DataSize = ALIGN_VARIABLE (DataSize + AuthKeyLength);
  598. DataSize = ALIGN_VARIABLE (DataSize + EncKeyLength);
  599. DataSize = ALIGN_VARIABLE (DataSize + sizeof (EFI_IPSEC_SPD_SELECTOR));
  600. DataSize = ALIGN_VARIABLE (DataSize + sizeof (EFI_IP_ADDRESS_INFO));
  601. DataSize += sizeof (EFI_IP_ADDRESS_INFO);
  602. *Data = AllocateZeroPool (DataSize);
  603. ASSERT (*Data != NULL);
  604. (*Data)->ManualSet = TRUE;
  605. (*Data)->AlgoInfo.EspAlgoInfo.AuthKey = (VOID *) ALIGN_POINTER (((*Data) + 1), sizeof (UINTN));
  606. (*Data)->AlgoInfo.EspAlgoInfo.EncKey = (VOID *) ALIGN_POINTER (
  607. ((UINT8 *) (*Data)->AlgoInfo.EspAlgoInfo.AuthKey + AuthKeyLength),
  608. sizeof (UINTN)
  609. );
  610. (*Data)->SpdSelector = (EFI_IPSEC_SPD_SELECTOR *) ALIGN_POINTER (
  611. ((UINT8 *) (*Data)->AlgoInfo.EspAlgoInfo.EncKey + EncKeyLength),
  612. sizeof (UINTN)
  613. );
  614. (*Data)->SpdSelector->LocalAddress = (EFI_IP_ADDRESS_INFO *) ALIGN_POINTER (
  615. ((UINT8 *) (*Data)->SpdSelector + sizeof (EFI_IPSEC_SPD_SELECTOR)),
  616. sizeof (UINTN));
  617. (*Data)->SpdSelector->RemoteAddress = (EFI_IP_ADDRESS_INFO *) ALIGN_POINTER (
  618. (*Data)->SpdSelector->LocalAddress + 1,
  619. sizeof (UINTN)
  620. );
  621. (*Data)->Mode = EfiIPsecTransport;
  622. Status = GetNumber (
  623. L"--mode",
  624. 0,
  625. &(*Data)->Mode,
  626. sizeof (EFI_IPSEC_MODE),
  627. mMapIpSecMode,
  628. ParamPackage,
  629. FORMAT_STRING
  630. );
  631. if (!EFI_ERROR (Status)) {
  632. *Mask |= MODE;
  633. }
  634. if (Status == EFI_INVALID_PARAMETER) {
  635. ReturnStatus = EFI_INVALID_PARAMETER;
  636. }
  637. //
  638. // According to RFC 4303-3.3.3. The first packet sent using a given SA
  639. // will contain a sequence number of 1.
  640. //
  641. (*Data)->SNCount = 1;
  642. Status = GetNumber (
  643. L"--sequence-number",
  644. (UINT64) -1,
  645. &(*Data)->SNCount,
  646. sizeof (UINT64),
  647. NULL,
  648. ParamPackage,
  649. FORMAT_NUMBER
  650. );
  651. if (!EFI_ERROR (Status)) {
  652. *Mask |= SEQUENCE_NUMBER;
  653. }
  654. if (Status == EFI_INVALID_PARAMETER) {
  655. ReturnStatus = EFI_INVALID_PARAMETER;
  656. }
  657. (*Data)->AntiReplayWindows = 0;
  658. Status = GetNumber (
  659. L"--antireplay-window",
  660. (UINT8) -1,
  661. &(*Data)->AntiReplayWindows,
  662. sizeof (UINT8),
  663. NULL,
  664. ParamPackage,
  665. FORMAT_NUMBER
  666. );
  667. if (!EFI_ERROR (Status)) {
  668. *Mask |= SEQUENCE_NUMBER;
  669. }
  670. if (Status == EFI_INVALID_PARAMETER) {
  671. ReturnStatus = EFI_INVALID_PARAMETER;
  672. }
  673. Status = GetNumber (
  674. L"--encrypt-algo",
  675. 0,
  676. &(*Data)->AlgoInfo.EspAlgoInfo.EncAlgoId,
  677. sizeof (UINT8),
  678. mMapEncAlgo,
  679. ParamPackage,
  680. FORMAT_STRING
  681. );
  682. if (!EFI_ERROR (Status)) {
  683. *Mask |= ENCRYPT_ALGO;
  684. }
  685. if (Status == EFI_INVALID_PARAMETER) {
  686. ReturnStatus = EFI_INVALID_PARAMETER;
  687. }
  688. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--encrypt-key");
  689. if (ValueStr != NULL ) {
  690. (*Data)->AlgoInfo.EspAlgoInfo.EncKeyLength = EncKeyLength;
  691. AsciiStr = AllocateZeroPool (EncKeyLength + 1);
  692. ASSERT (AsciiStr != NULL);
  693. UnicodeStrToAsciiStrS (ValueStr, AsciiStr, EncKeyLength + 1);
  694. CopyMem ((*Data)->AlgoInfo.EspAlgoInfo.EncKey, AsciiStr, EncKeyLength);
  695. FreePool (AsciiStr);
  696. *Mask |= ENCRYPT_KEY;
  697. } else {
  698. (*Data)->AlgoInfo.EspAlgoInfo.EncKey = NULL;
  699. }
  700. Status = GetNumber (
  701. L"--auth-algo",
  702. 0,
  703. &(*Data)->AlgoInfo.EspAlgoInfo.AuthAlgoId,
  704. sizeof (UINT8),
  705. mMapAuthAlgo,
  706. ParamPackage,
  707. FORMAT_STRING
  708. );
  709. if (!EFI_ERROR (Status)) {
  710. *Mask |= AUTH_ALGO;
  711. }
  712. if (Status == EFI_INVALID_PARAMETER) {
  713. ReturnStatus = EFI_INVALID_PARAMETER;
  714. }
  715. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--auth-key");
  716. if (ValueStr != NULL) {
  717. (*Data)->AlgoInfo.EspAlgoInfo.AuthKeyLength = AuthKeyLength;
  718. AsciiStr = AllocateZeroPool (AuthKeyLength + 1);
  719. ASSERT (AsciiStr != NULL);
  720. UnicodeStrToAsciiStrS (ValueStr, AsciiStr, AuthKeyLength + 1);
  721. CopyMem ((*Data)->AlgoInfo.EspAlgoInfo.AuthKey, AsciiStr, AuthKeyLength);
  722. FreePool (AsciiStr);
  723. *Mask |= AUTH_KEY;
  724. } else {
  725. (*Data)->AlgoInfo.EspAlgoInfo.AuthKey = NULL;
  726. }
  727. Status = GetNumber (
  728. L"--lifebyte",
  729. (UINT64) -1,
  730. &(*Data)->SaLifetime.ByteCount,
  731. sizeof (UINT64),
  732. NULL,
  733. ParamPackage,
  734. FORMAT_NUMBER
  735. );
  736. if (!EFI_ERROR (Status)) {
  737. *Mask |= LIFEBYTE;
  738. }
  739. if (Status == EFI_INVALID_PARAMETER) {
  740. ReturnStatus = EFI_INVALID_PARAMETER;
  741. }
  742. Status = GetNumber (
  743. L"--lifetime",
  744. (UINT64) -1,
  745. &(*Data)->SaLifetime.HardLifetime,
  746. sizeof (UINT64),
  747. NULL,
  748. ParamPackage,
  749. FORMAT_NUMBER
  750. );
  751. if (!EFI_ERROR (Status)) {
  752. *Mask |= LIFETIME;
  753. }
  754. if (Status == EFI_INVALID_PARAMETER) {
  755. ReturnStatus = EFI_INVALID_PARAMETER;
  756. }
  757. Status = GetNumber (
  758. L"--lifetime-soft",
  759. (UINT64) -1,
  760. &(*Data)->SaLifetime.SoftLifetime,
  761. sizeof (UINT64),
  762. NULL,
  763. ParamPackage,
  764. FORMAT_NUMBER
  765. );
  766. if (!EFI_ERROR (Status)) {
  767. *Mask |= LIFETIME_SOFT;
  768. }
  769. if (Status == EFI_INVALID_PARAMETER) {
  770. ReturnStatus = EFI_INVALID_PARAMETER;
  771. }
  772. Status = GetNumber (
  773. L"--path-mtu",
  774. (UINT32) -1,
  775. &(*Data)->PathMTU,
  776. sizeof (UINT32),
  777. NULL,
  778. ParamPackage,
  779. FORMAT_NUMBER
  780. );
  781. if (!EFI_ERROR (Status)) {
  782. *Mask |= PATH_MTU;
  783. }
  784. if (Status == EFI_INVALID_PARAMETER) {
  785. ReturnStatus = EFI_INVALID_PARAMETER;
  786. }
  787. //
  788. // Convert user imput from string to integer, and fill in the DestAddress in EFI_IPSEC_SA_ID.
  789. //
  790. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--tunnel-dest");
  791. if (ValueStr != NULL) {
  792. Status = EfiInetAddr2 ((CHAR16 *) ValueStr, &(*Data)->TunnelDestinationAddress);
  793. if (EFI_ERROR (Status)) {
  794. ShellPrintHiiEx (
  795. -1,
  796. -1,
  797. NULL,
  798. STRING_TOKEN (STR_IPSEC_CONFIG_INCORRECT_PARAMETER_VALUE),
  799. mHiiHandle,
  800. mAppName,
  801. L"--tunnel-dest",
  802. ValueStr
  803. );
  804. ReturnStatus = EFI_INVALID_PARAMETER;
  805. } else {
  806. *Mask |= DEST;
  807. }
  808. }
  809. //
  810. // Convert user input from string to integer, and fill in the DestAddress in EFI_IPSEC_SA_ID.
  811. //
  812. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--tunnel-source");
  813. if (ValueStr != NULL) {
  814. Status = EfiInetAddr2 ((CHAR16 *) ValueStr, &(*Data)->TunnelSourceAddress);
  815. if (EFI_ERROR (Status)) {
  816. ShellPrintHiiEx (
  817. -1,
  818. -1,
  819. NULL,
  820. STRING_TOKEN (STR_IPSEC_CONFIG_INCORRECT_PARAMETER_VALUE),
  821. mHiiHandle,
  822. mAppName,
  823. L"--tunnel-source",
  824. ValueStr
  825. );
  826. ReturnStatus = EFI_INVALID_PARAMETER;
  827. } else {
  828. *Mask |= SOURCE;
  829. }
  830. }
  831. //
  832. // If it is TunnelMode, then check if the tunnel-source and --tunnel-dest are set
  833. //
  834. if ((*Data)->Mode == EfiIPsecTunnel) {
  835. if ((*Mask & (DEST|SOURCE)) != (DEST|SOURCE)) {
  836. ShellPrintHiiEx (
  837. -1,
  838. -1,
  839. NULL,
  840. STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_ONE_OF_PARAMETERS),
  841. mHiiHandle,
  842. mAppName,
  843. L"--tunnel-source --tunnel-dest"
  844. );
  845. ReturnStatus = EFI_INVALID_PARAMETER;
  846. }
  847. }
  848. ReturnStatus = CreateSpdSelector ((*Data)->SpdSelector, ParamPackage, Mask);
  849. if (CreateNew) {
  850. if ((*Mask & (SPI|IPSEC_PROTO|LOCAL|REMOTE)) != (SPI|IPSEC_PROTO|LOCAL|REMOTE)) {
  851. ShellPrintHiiEx (
  852. -1,
  853. -1,
  854. NULL,
  855. STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_ONE_OF_PARAMETERS),
  856. mHiiHandle,
  857. mAppName,
  858. L"--spi --ipsec-proto --local --remote"
  859. );
  860. ReturnStatus = EFI_INVALID_PARAMETER;
  861. } else {
  862. if ((*SaId)->Proto == EfiIPsecAH) {
  863. if ((*Mask & AUTH_ALGO) == 0) {
  864. ShellPrintHiiEx (
  865. -1,
  866. -1,
  867. NULL,
  868. STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_PARAMETER),
  869. mHiiHandle,
  870. mAppName,
  871. L"--auth-algo"
  872. );
  873. ReturnStatus = EFI_INVALID_PARAMETER;
  874. } else if ((*Data)->AlgoInfo.EspAlgoInfo.AuthAlgoId != IPSEC_AALG_NONE && (*Mask & AUTH_KEY) == 0) {
  875. ShellPrintHiiEx (
  876. -1,
  877. -1,
  878. NULL,
  879. STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_PARAMETER),
  880. mHiiHandle,
  881. mAppName,
  882. L"--auth-key"
  883. );
  884. ReturnStatus = EFI_INVALID_PARAMETER;
  885. }
  886. } else {
  887. if ((*Mask & (ENCRYPT_ALGO|AUTH_ALGO)) != (ENCRYPT_ALGO|AUTH_ALGO) ) {
  888. ShellPrintHiiEx (
  889. -1,
  890. -1,
  891. NULL,
  892. STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_PARAMETER),
  893. mHiiHandle,
  894. mAppName,
  895. L"--encrypt-algo --auth-algo"
  896. );
  897. ReturnStatus = EFI_INVALID_PARAMETER;
  898. } else if ((*Data)->AlgoInfo.EspAlgoInfo.EncAlgoId != IPSEC_EALG_NONE && (*Mask & ENCRYPT_KEY) == 0) {
  899. ShellPrintHiiEx (
  900. -1,
  901. -1,
  902. NULL,
  903. STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_PARAMETER),
  904. mHiiHandle,
  905. mAppName,
  906. L"--encrypt-key"
  907. );
  908. ReturnStatus = EFI_INVALID_PARAMETER;
  909. } else if ((*Data)->AlgoInfo.EspAlgoInfo.AuthAlgoId != IPSEC_AALG_NONE && (*Mask & AUTH_KEY) == 0) {
  910. ShellPrintHiiEx (
  911. -1,
  912. -1,
  913. NULL,
  914. STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_PARAMETER),
  915. mHiiHandle,
  916. mAppName,
  917. L"--auth-key"
  918. );
  919. ReturnStatus = EFI_INVALID_PARAMETER;
  920. }
  921. }
  922. }
  923. }
  924. return ReturnStatus;
  925. }
  926. /**
  927. Fill in EFI_IPSEC_PAD_ID and EFI_IPSEC_PAD_DATA through ParamPackage list.
  928. @param[out] PadId The pointer to the EFI_IPSEC_PAD_ID structure.
  929. @param[out] Data The pointer to the EFI_IPSEC_PAD_DATA structure.
  930. @param[in] ParamPackage The pointer to the ParamPackage list.
  931. @param[out] Mask The pointer to the Mask.
  932. @param[in] CreateNew The switch to create new.
  933. @retval EFI_SUCCESS Fill in EFI_IPSEC_PAD_ID and EFI_IPSEC_PAD_DATA successfully.
  934. @retval EFI_INVALID_PARAMETER Invalid user input parameter.
  935. **/
  936. EFI_STATUS
  937. CreatePadEntry (
  938. OUT EFI_IPSEC_PAD_ID **PadId,
  939. OUT EFI_IPSEC_PAD_DATA **Data,
  940. IN LIST_ENTRY *ParamPackage,
  941. OUT UINT32 *Mask,
  942. IN BOOLEAN CreateNew
  943. )
  944. {
  945. EFI_STATUS Status;
  946. EFI_STATUS ReturnStatus;
  947. SHELL_FILE_HANDLE FileHandle;
  948. UINT64 FileSize;
  949. UINTN AuthDataLength;
  950. UINTN RevocationDataLength;
  951. UINTN DataLength;
  952. UINTN Index;
  953. CONST CHAR16 *ValueStr;
  954. UINTN DataSize;
  955. Status = EFI_SUCCESS;
  956. ReturnStatus = EFI_SUCCESS;
  957. *Mask = 0;
  958. AuthDataLength = 0;
  959. RevocationDataLength = 0;
  960. *PadId = AllocateZeroPool (sizeof (EFI_IPSEC_PAD_ID));
  961. ASSERT (*PadId != NULL);
  962. //
  963. // Convert user imput from string to integer, and fill in EFI_IPSEC_PAD_ID.
  964. //
  965. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--peer-address");
  966. if (ValueStr != NULL) {
  967. (*PadId)->PeerIdValid = FALSE;
  968. Status = EfiInetAddrRange ((CHAR16 *) ValueStr, &(*PadId)->Id.IpAddress);
  969. if (EFI_ERROR (Status)) {
  970. ShellPrintHiiEx (
  971. -1,
  972. -1,
  973. NULL,
  974. STRING_TOKEN (STR_IPSEC_CONFIG_INCORRECT_PARAMETER_VALUE),
  975. mHiiHandle,
  976. mAppName,
  977. L"--peer-address",
  978. ValueStr
  979. );
  980. ReturnStatus = EFI_INVALID_PARAMETER;
  981. } else {
  982. *Mask |= PEER_ADDRESS;
  983. }
  984. }
  985. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--peer-id");
  986. if (ValueStr != NULL) {
  987. (*PadId)->PeerIdValid = TRUE;
  988. StrnCpyS ((CHAR16 *) (*PadId)->Id.PeerId, MAX_PEERID_LEN / sizeof (CHAR16), ValueStr, MAX_PEERID_LEN / sizeof (CHAR16) - 1);
  989. *Mask |= PEER_ID;
  990. }
  991. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--auth-data");
  992. if (ValueStr != NULL) {
  993. if (ValueStr[0] == L'@') {
  994. //
  995. // Input is a file: --auth-data "@fs1:\My Certificates\tom.dat"
  996. //
  997. Status = ShellOpenFileByName (&ValueStr[1], &FileHandle, EFI_FILE_MODE_READ, 0);
  998. if (EFI_ERROR (Status)) {
  999. ShellPrintHiiEx (
  1000. -1,
  1001. -1,
  1002. NULL,
  1003. STRING_TOKEN (STR_IPSEC_CONFIG_FILE_OPEN_FAILED),
  1004. mHiiHandle,
  1005. mAppName,
  1006. &ValueStr[1]
  1007. );
  1008. ReturnStatus = EFI_INVALID_PARAMETER;
  1009. } else {
  1010. Status = ShellGetFileSize (FileHandle, &FileSize);
  1011. ShellCloseFile (&FileHandle);
  1012. if (EFI_ERROR (Status)) {
  1013. ShellPrintHiiEx (
  1014. -1,
  1015. -1,
  1016. NULL,
  1017. STRING_TOKEN (STR_IPSEC_CONFIG_FILE_OPEN_FAILED),
  1018. mHiiHandle,
  1019. mAppName,
  1020. &ValueStr[1]
  1021. );
  1022. ReturnStatus = EFI_INVALID_PARAMETER;
  1023. } else {
  1024. AuthDataLength = (UINTN) FileSize;
  1025. }
  1026. }
  1027. } else {
  1028. AuthDataLength = StrLen (ValueStr);
  1029. }
  1030. }
  1031. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--revocation-data");
  1032. if (ValueStr != NULL) {
  1033. RevocationDataLength = (StrLen (ValueStr) + 1) * sizeof (CHAR16);
  1034. }
  1035. //
  1036. // Allocate Buffer for Data. Add padding after each struct to make sure the alignment
  1037. // in different Arch.
  1038. //
  1039. DataSize = ALIGN_VARIABLE (sizeof (EFI_IPSEC_PAD_DATA));
  1040. DataSize = ALIGN_VARIABLE (DataSize + AuthDataLength);
  1041. DataSize += RevocationDataLength;
  1042. *Data = AllocateZeroPool (DataSize);
  1043. ASSERT (*Data != NULL);
  1044. (*Data)->AuthData = (VOID *) ALIGN_POINTER ((*Data + 1), sizeof (UINTN));
  1045. (*Data)->RevocationData = (VOID *) ALIGN_POINTER (((UINT8 *) (*Data + 1) + AuthDataLength), sizeof (UINTN));
  1046. (*Data)->AuthProtocol = EfiIPsecAuthProtocolIKEv1;
  1047. //
  1048. // Convert user imput from string to integer, and fill in EFI_IPSEC_PAD_DATA.
  1049. //
  1050. Status = GetNumber (
  1051. L"--auth-proto",
  1052. 0,
  1053. &(*Data)->AuthProtocol,
  1054. sizeof (EFI_IPSEC_AUTH_PROTOCOL_TYPE),
  1055. mMapAuthProto,
  1056. ParamPackage,
  1057. FORMAT_STRING
  1058. );
  1059. if (!EFI_ERROR (Status)) {
  1060. *Mask |= AUTH_PROTO;
  1061. }
  1062. if (Status == EFI_INVALID_PARAMETER) {
  1063. ReturnStatus = EFI_INVALID_PARAMETER;
  1064. }
  1065. Status = GetNumber (
  1066. L"--auth-method",
  1067. 0,
  1068. &(*Data)->AuthMethod,
  1069. sizeof (EFI_IPSEC_AUTH_METHOD),
  1070. mMapAuthMethod,
  1071. ParamPackage,
  1072. FORMAT_STRING
  1073. );
  1074. if (!EFI_ERROR (Status)) {
  1075. *Mask |= AUTH_METHOD;
  1076. }
  1077. if (Status == EFI_INVALID_PARAMETER) {
  1078. ReturnStatus = EFI_INVALID_PARAMETER;
  1079. }
  1080. if (ShellCommandLineGetFlag (ParamPackage, L"--ike-id")) {
  1081. (*Data)->IkeIdFlag = TRUE;
  1082. *Mask |= IKE_ID;
  1083. }
  1084. if (ShellCommandLineGetFlag (ParamPackage, L"--ike-id-")) {
  1085. (*Data)->IkeIdFlag = FALSE;
  1086. *Mask |= IKE_ID;
  1087. }
  1088. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--auth-data");
  1089. if (ValueStr != NULL) {
  1090. if (ValueStr[0] == L'@') {
  1091. //
  1092. // Input is a file: --auth-data "@fs1:\My Certificates\tom.dat"
  1093. //
  1094. Status = ShellOpenFileByName (&ValueStr[1], &FileHandle, EFI_FILE_MODE_READ, 0);
  1095. if (EFI_ERROR (Status)) {
  1096. ShellPrintHiiEx (
  1097. -1,
  1098. -1,
  1099. NULL,
  1100. STRING_TOKEN (STR_IPSEC_CONFIG_FILE_OPEN_FAILED),
  1101. mHiiHandle,
  1102. mAppName,
  1103. &ValueStr[1]
  1104. );
  1105. ReturnStatus = EFI_INVALID_PARAMETER;
  1106. (*Data)->AuthData = NULL;
  1107. } else {
  1108. DataLength = AuthDataLength;
  1109. Status = ShellReadFile (FileHandle, &DataLength, (*Data)->AuthData);
  1110. ShellCloseFile (&FileHandle);
  1111. if (EFI_ERROR (Status)) {
  1112. ShellPrintHiiEx (
  1113. -1,
  1114. -1,
  1115. NULL,
  1116. STRING_TOKEN (STR_IPSEC_CONFIG_FILE_OPEN_FAILED),
  1117. mHiiHandle,
  1118. mAppName,
  1119. &ValueStr[1]
  1120. );
  1121. ReturnStatus = EFI_INVALID_PARAMETER;
  1122. (*Data)->AuthData = NULL;
  1123. } else {
  1124. ASSERT (DataLength == AuthDataLength);
  1125. *Mask |= AUTH_DATA;
  1126. }
  1127. }
  1128. } else {
  1129. for (Index = 0; Index < AuthDataLength; Index++) {
  1130. ((CHAR8 *) (*Data)->AuthData)[Index] = (CHAR8) ValueStr[Index];
  1131. }
  1132. (*Data)->AuthDataSize = AuthDataLength;
  1133. *Mask |= AUTH_DATA;
  1134. }
  1135. }
  1136. ValueStr = ShellCommandLineGetValue (ParamPackage, L"--revocation-data");
  1137. if (ValueStr != NULL) {
  1138. CopyMem ((*Data)->RevocationData, ValueStr, RevocationDataLength);
  1139. (*Data)->RevocationDataSize = RevocationDataLength;
  1140. *Mask |= REVOCATION_DATA;
  1141. } else {
  1142. (*Data)->RevocationData = NULL;
  1143. }
  1144. if (CreateNew) {
  1145. if ((*Mask & (PEER_ID | PEER_ADDRESS)) == 0) {
  1146. ShellPrintHiiEx (
  1147. -1,
  1148. -1,
  1149. NULL,
  1150. STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_ONE_OF_PARAMETERS),
  1151. mHiiHandle,
  1152. mAppName,
  1153. L"--peer-id --peer-address"
  1154. );
  1155. ReturnStatus = EFI_INVALID_PARAMETER;
  1156. } else if ((*Mask & (AUTH_METHOD | AUTH_DATA)) != (AUTH_METHOD | AUTH_DATA)) {
  1157. ShellPrintHiiEx (
  1158. -1,
  1159. -1,
  1160. NULL,
  1161. STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_ONE_OF_PARAMETERS),
  1162. mHiiHandle,
  1163. mAppName,
  1164. L"--auth-method --auth-data"
  1165. );
  1166. ReturnStatus = EFI_INVALID_PARAMETER;
  1167. }
  1168. }
  1169. return ReturnStatus;
  1170. }
  1171. CREATE_POLICY_ENTRY mCreatePolicyEntry[] = {
  1172. (CREATE_POLICY_ENTRY) CreateSpdEntry,
  1173. (CREATE_POLICY_ENTRY) CreateSadEntry,
  1174. (CREATE_POLICY_ENTRY) CreatePadEntry
  1175. };
  1176. /**
  1177. Combine old SPD entry with new SPD entry.
  1178. @param[in, out] OldSelector The pointer to the EFI_IPSEC_SPD_SELECTOR structure.
  1179. @param[in, out] OldData The pointer to the EFI_IPSEC_SPD_DATA structure.
  1180. @param[in] NewSelector The pointer to the EFI_IPSEC_SPD_SELECTOR structure.
  1181. @param[in] NewData The pointer to the EFI_IPSEC_SPD_DATA structure.
  1182. @param[in] Mask The pointer to the Mask.
  1183. @param[out] CreateNew The switch to create new.
  1184. @retval EFI_SUCCESS Combined successfully.
  1185. @retval EFI_INVALID_PARAMETER Invalid user input parameter.
  1186. **/
  1187. EFI_STATUS
  1188. CombineSpdEntry (
  1189. IN OUT EFI_IPSEC_SPD_SELECTOR *OldSelector,
  1190. IN OUT EFI_IPSEC_SPD_DATA *OldData,
  1191. IN EFI_IPSEC_SPD_SELECTOR *NewSelector,
  1192. IN EFI_IPSEC_SPD_DATA *NewData,
  1193. IN UINT32 Mask,
  1194. OUT BOOLEAN *CreateNew
  1195. )
  1196. {
  1197. //
  1198. // Process Selector
  1199. //
  1200. *CreateNew = FALSE;
  1201. if ((Mask & LOCAL) == 0) {
  1202. NewSelector->LocalAddressCount = OldSelector->LocalAddressCount;
  1203. NewSelector->LocalAddress = OldSelector->LocalAddress;
  1204. } else if ((NewSelector->LocalAddressCount != OldSelector->LocalAddressCount) ||
  1205. (CompareMem (NewSelector->LocalAddress, OldSelector->LocalAddress, NewSelector->LocalAddressCount * sizeof (EFI_IP_ADDRESS_INFO)) != 0)) {
  1206. *CreateNew = TRUE;
  1207. }
  1208. if ((Mask & REMOTE) == 0) {
  1209. NewSelector->RemoteAddressCount = OldSelector->RemoteAddressCount;
  1210. NewSelector->RemoteAddress = OldSelector->RemoteAddress;
  1211. } else if ((NewSelector->RemoteAddressCount != OldSelector->RemoteAddressCount) ||
  1212. (CompareMem (NewSelector->RemoteAddress, OldSelector->RemoteAddress, NewSelector->RemoteAddressCount * sizeof (EFI_IP_ADDRESS_INFO)) != 0)) {
  1213. *CreateNew = TRUE;
  1214. }
  1215. if ((Mask & PROTO) == 0) {
  1216. NewSelector->NextLayerProtocol = OldSelector->NextLayerProtocol;
  1217. } else if (NewSelector->NextLayerProtocol != OldSelector->NextLayerProtocol) {
  1218. *CreateNew = TRUE;
  1219. }
  1220. switch (NewSelector->NextLayerProtocol) {
  1221. case EFI_IP4_PROTO_TCP:
  1222. case EFI_IP4_PROTO_UDP:
  1223. if ((Mask & LOCAL_PORT) == 0) {
  1224. NewSelector->LocalPort = OldSelector->LocalPort;
  1225. NewSelector->LocalPortRange = OldSelector->LocalPortRange;
  1226. } else if ((NewSelector->LocalPort != OldSelector->LocalPort) ||
  1227. (NewSelector->LocalPortRange != OldSelector->LocalPortRange)) {
  1228. *CreateNew = TRUE;
  1229. }
  1230. if ((Mask & REMOTE_PORT) == 0) {
  1231. NewSelector->RemotePort = OldSelector->RemotePort;
  1232. NewSelector->RemotePortRange = OldSelector->RemotePortRange;
  1233. } else if ((NewSelector->RemotePort != OldSelector->RemotePort) ||
  1234. (NewSelector->RemotePortRange != OldSelector->RemotePortRange)) {
  1235. *CreateNew = TRUE;
  1236. }
  1237. break;
  1238. case EFI_IP4_PROTO_ICMP:
  1239. if ((Mask & ICMP_TYPE) == 0) {
  1240. NewSelector->LocalPort = OldSelector->LocalPort;
  1241. } else if (NewSelector->LocalPort != OldSelector->LocalPort) {
  1242. *CreateNew = TRUE;
  1243. }
  1244. if ((Mask & ICMP_CODE) == 0) {
  1245. NewSelector->RemotePort = OldSelector->RemotePort;
  1246. } else if (NewSelector->RemotePort != OldSelector->RemotePort) {
  1247. *CreateNew = TRUE;
  1248. }
  1249. break;
  1250. }
  1251. //
  1252. // Process Data
  1253. //
  1254. OldData->SaIdCount = 0;
  1255. if ((Mask & NAME) != 0) {
  1256. AsciiStrCpyS ((CHAR8 *) OldData->Name, MAX_PEERID_LEN, (CHAR8 *) NewData->Name);
  1257. }
  1258. if ((Mask & PACKET_FLAG) != 0) {
  1259. OldData->PackageFlag = NewData->PackageFlag;
  1260. }
  1261. if ((Mask & ACTION) != 0) {
  1262. OldData->Action = NewData->Action;
  1263. }
  1264. if (OldData->Action != EfiIPsecActionProtect) {
  1265. OldData->ProcessingPolicy = NULL;
  1266. } else {
  1267. //
  1268. // Protect
  1269. //
  1270. if (OldData->ProcessingPolicy == NULL) {
  1271. //
  1272. // Just point to new data if originally NULL.
  1273. //
  1274. OldData->ProcessingPolicy = NewData->ProcessingPolicy;
  1275. if (OldData->ProcessingPolicy->Mode == EfiIPsecTunnel &&
  1276. (Mask & (TUNNEL_LOCAL | TUNNEL_REMOTE)) != (TUNNEL_LOCAL | TUNNEL_REMOTE)
  1277. ) {
  1278. //
  1279. // Change to Protect action and Tunnel mode, but without providing local/remote tunnel address.
  1280. //
  1281. ShellPrintHiiEx (
  1282. -1,
  1283. -1,
  1284. NULL,
  1285. STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_ONE_OF_PARAMETERS),
  1286. mHiiHandle,
  1287. mAppName,
  1288. L"--tunnel-local --tunnel-remote"
  1289. );
  1290. return EFI_INVALID_PARAMETER;
  1291. }
  1292. } else {
  1293. //
  1294. // Modify some of the data.
  1295. //
  1296. if ((Mask & EXT_SEQUENCE) != 0) {
  1297. OldData->ProcessingPolicy->ExtSeqNum = NewData->ProcessingPolicy->ExtSeqNum;
  1298. }
  1299. if ((Mask & SEQUENCE_OVERFLOW) != 0) {
  1300. OldData->ProcessingPolicy->SeqOverflow = NewData->ProcessingPolicy->SeqOverflow;
  1301. }
  1302. if ((Mask & FRAGMENT_CHECK) != 0) {
  1303. OldData->ProcessingPolicy->FragCheck = NewData->ProcessingPolicy->FragCheck;
  1304. }
  1305. if ((Mask & LIFEBYTE) != 0) {
  1306. OldData->ProcessingPolicy->SaLifetime.ByteCount = NewData->ProcessingPolicy->SaLifetime.ByteCount;
  1307. }
  1308. if ((Mask & LIFETIME_SOFT) != 0) {
  1309. OldData->ProcessingPolicy->SaLifetime.SoftLifetime = NewData->ProcessingPolicy->SaLifetime.SoftLifetime;
  1310. }
  1311. if ((Mask & LIFETIME) != 0) {
  1312. OldData->ProcessingPolicy->SaLifetime.HardLifetime = NewData->ProcessingPolicy->SaLifetime.HardLifetime;
  1313. }
  1314. if ((Mask & MODE) != 0) {
  1315. OldData->ProcessingPolicy->Mode = NewData->ProcessingPolicy->Mode;
  1316. }
  1317. if ((Mask & IPSEC_PROTO) != 0) {
  1318. OldData->ProcessingPolicy->Proto = NewData->ProcessingPolicy->Proto;
  1319. }
  1320. if ((Mask & AUTH_ALGO) != 0) {
  1321. OldData->ProcessingPolicy->AuthAlgoId = NewData->ProcessingPolicy->AuthAlgoId;
  1322. }
  1323. if ((Mask & ENCRYPT_ALGO) != 0) {
  1324. OldData->ProcessingPolicy->EncAlgoId = NewData->ProcessingPolicy->EncAlgoId;
  1325. }
  1326. if (OldData->ProcessingPolicy->Mode != EfiIPsecTunnel) {
  1327. OldData->ProcessingPolicy->TunnelOption = NULL;
  1328. } else {
  1329. if (OldData->ProcessingPolicy->TunnelOption == NULL) {
  1330. //
  1331. // Set from Transport mode to Tunnel mode, should ensure TUNNEL_LOCAL & TUNNEL_REMOTE both exists.
  1332. //
  1333. if ((Mask & (TUNNEL_LOCAL | TUNNEL_REMOTE)) != (TUNNEL_LOCAL | TUNNEL_REMOTE)) {
  1334. ShellPrintHiiEx (
  1335. -1,
  1336. -1,
  1337. NULL,
  1338. STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_ONE_OF_PARAMETERS),
  1339. mHiiHandle,
  1340. mAppName,
  1341. L"--tunnel-local --tunnel-remote"
  1342. );
  1343. return EFI_INVALID_PARAMETER;
  1344. }
  1345. OldData->ProcessingPolicy->TunnelOption = NewData->ProcessingPolicy->TunnelOption;
  1346. } else {
  1347. if ((Mask & TUNNEL_LOCAL) != 0) {
  1348. CopyMem (
  1349. &OldData->ProcessingPolicy->TunnelOption->LocalTunnelAddress,
  1350. &NewData->ProcessingPolicy->TunnelOption->LocalTunnelAddress,
  1351. sizeof (EFI_IP_ADDRESS)
  1352. );
  1353. }
  1354. if ((Mask & TUNNEL_REMOTE) != 0) {
  1355. CopyMem (
  1356. &OldData->ProcessingPolicy->TunnelOption->RemoteTunnelAddress,
  1357. &NewData->ProcessingPolicy->TunnelOption->RemoteTunnelAddress,
  1358. sizeof (EFI_IP_ADDRESS)
  1359. );
  1360. }
  1361. if ((Mask & DONT_FRAGMENT) != 0) {
  1362. OldData->ProcessingPolicy->TunnelOption->DF = NewData->ProcessingPolicy->TunnelOption->DF;
  1363. }
  1364. }
  1365. }
  1366. }
  1367. }
  1368. return EFI_SUCCESS;
  1369. }
  1370. /**
  1371. Combine old SAD entry with new SAD entry.
  1372. @param[in, out] OldSaId The pointer to the EFI_IPSEC_SA_ID structure.
  1373. @param[in, out] OldData The pointer to the EFI_IPSEC_SA_DATA2 structure.
  1374. @param[in] NewSaId The pointer to the EFI_IPSEC_SA_ID structure.
  1375. @param[in] NewData The pointer to the EFI_IPSEC_SA_DATA2 structure.
  1376. @param[in] Mask The pointer to the Mask.
  1377. @param[out] CreateNew The switch to create new.
  1378. @retval EFI_SUCCESS Combined successfully.
  1379. @retval EFI_INVALID_PARAMETER Invalid user input parameter.
  1380. **/
  1381. EFI_STATUS
  1382. CombineSadEntry (
  1383. IN OUT EFI_IPSEC_SA_ID *OldSaId,
  1384. IN OUT EFI_IPSEC_SA_DATA2 *OldData,
  1385. IN EFI_IPSEC_SA_ID *NewSaId,
  1386. IN EFI_IPSEC_SA_DATA2 *NewData,
  1387. IN UINT32 Mask,
  1388. OUT BOOLEAN *CreateNew
  1389. )
  1390. {
  1391. *CreateNew = FALSE;
  1392. if ((Mask & SPI) == 0) {
  1393. NewSaId->Spi = OldSaId->Spi;
  1394. } else if (NewSaId->Spi != OldSaId->Spi) {
  1395. *CreateNew = TRUE;
  1396. }
  1397. if ((Mask & IPSEC_PROTO) == 0) {
  1398. NewSaId->Proto = OldSaId->Proto;
  1399. } else if (NewSaId->Proto != OldSaId->Proto) {
  1400. *CreateNew = TRUE;
  1401. }
  1402. if ((Mask & DEST) == 0) {
  1403. CopyMem (&NewData->TunnelDestinationAddress, &OldData->TunnelDestinationAddress, sizeof (EFI_IP_ADDRESS));
  1404. } else if (CompareMem (&NewData->TunnelDestinationAddress, &OldData->TunnelDestinationAddress, sizeof (EFI_IP_ADDRESS)) != 0) {
  1405. *CreateNew = TRUE;
  1406. }
  1407. if ((Mask & SOURCE) == 0) {
  1408. CopyMem (&NewData->TunnelSourceAddress, &OldData->TunnelSourceAddress, sizeof (EFI_IP_ADDRESS));
  1409. } else if (CompareMem (&NewData->TunnelSourceAddress, &OldData->TunnelSourceAddress, sizeof (EFI_IP_ADDRESS)) != 0) {
  1410. *CreateNew = TRUE;
  1411. }
  1412. //
  1413. // Process SA_DATA.
  1414. //
  1415. if ((Mask & MODE) != 0) {
  1416. OldData->Mode = NewData->Mode;
  1417. }
  1418. if ((Mask & SEQUENCE_NUMBER) != 0) {
  1419. OldData->SNCount = NewData->SNCount;
  1420. }
  1421. if ((Mask & ANTIREPLAY_WINDOW) != 0) {
  1422. OldData->AntiReplayWindows = NewData->AntiReplayWindows;
  1423. }
  1424. if ((Mask & AUTH_ALGO) != 0) {
  1425. OldData->AlgoInfo.EspAlgoInfo.AuthAlgoId = NewData->AlgoInfo.EspAlgoInfo.AuthAlgoId;
  1426. }
  1427. if ((Mask & AUTH_KEY) != 0) {
  1428. OldData->AlgoInfo.EspAlgoInfo.AuthKey = NewData->AlgoInfo.EspAlgoInfo.AuthKey;
  1429. OldData->AlgoInfo.EspAlgoInfo.AuthKeyLength = NewData->AlgoInfo.EspAlgoInfo.AuthKeyLength;
  1430. }
  1431. if ((Mask & ENCRYPT_ALGO) != 0) {
  1432. OldData->AlgoInfo.EspAlgoInfo.EncAlgoId = NewData->AlgoInfo.EspAlgoInfo.EncAlgoId;
  1433. }
  1434. if ((Mask & ENCRYPT_KEY) != 0) {
  1435. OldData->AlgoInfo.EspAlgoInfo.EncKey = NewData->AlgoInfo.EspAlgoInfo.EncKey;
  1436. OldData->AlgoInfo.EspAlgoInfo.EncKeyLength = NewData->AlgoInfo.EspAlgoInfo.EncKeyLength;
  1437. }
  1438. if (NewSaId->Proto == EfiIPsecAH) {
  1439. if ((Mask & (ENCRYPT_ALGO | ENCRYPT_KEY)) != 0) {
  1440. //
  1441. // Should not provide encrypt_* if AH.
  1442. //
  1443. ShellPrintHiiEx (
  1444. -1,
  1445. -1,
  1446. NULL,
  1447. STRING_TOKEN (STR_IPSEC_CONFIG_UNWANTED_PARAMETER),
  1448. mHiiHandle,
  1449. mAppName,
  1450. L"--encrypt-algo --encrypt-key"
  1451. );
  1452. return EFI_INVALID_PARAMETER;
  1453. }
  1454. }
  1455. if (NewSaId->Proto == EfiIPsecESP && OldSaId->Proto == EfiIPsecAH) {
  1456. //
  1457. // AH -> ESP
  1458. // Should provide encrypt_algo at least.
  1459. //
  1460. if ((Mask & ENCRYPT_ALGO) == 0) {
  1461. ShellPrintHiiEx (
  1462. -1,
  1463. -1,
  1464. NULL,
  1465. STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_PARAMETER),
  1466. mHiiHandle,
  1467. mAppName,
  1468. L"--encrypt-algo"
  1469. );
  1470. return EFI_INVALID_PARAMETER;
  1471. }
  1472. //
  1473. // Encrypt_key should be provided if algorithm is not NONE.
  1474. //
  1475. if (NewData->AlgoInfo.EspAlgoInfo.EncAlgoId != IPSEC_EALG_NONE && (Mask & ENCRYPT_KEY) == 0) {
  1476. ShellPrintHiiEx (
  1477. -1,
  1478. -1,
  1479. NULL,
  1480. STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_PARAMETER),
  1481. mHiiHandle,
  1482. mAppName,
  1483. L"--encrypt-algo"
  1484. );
  1485. return EFI_INVALID_PARAMETER;
  1486. }
  1487. }
  1488. if ((Mask & LIFEBYTE) != 0) {
  1489. OldData->SaLifetime.ByteCount = NewData->SaLifetime.ByteCount;
  1490. }
  1491. if ((Mask & LIFETIME_SOFT) != 0) {
  1492. OldData->SaLifetime.SoftLifetime = NewData->SaLifetime.SoftLifetime;
  1493. }
  1494. if ((Mask & LIFETIME) != 0) {
  1495. OldData->SaLifetime.HardLifetime = NewData->SaLifetime.HardLifetime;
  1496. }
  1497. if ((Mask & PATH_MTU) != 0) {
  1498. OldData->PathMTU = NewData->PathMTU;
  1499. }
  1500. //
  1501. // Process SpdSelector.
  1502. //
  1503. if (OldData->SpdSelector == NULL) {
  1504. if ((Mask & (LOCAL | REMOTE | PROTO | LOCAL_PORT | REMOTE_PORT | ICMP_TYPE | ICMP_CODE)) != 0) {
  1505. if ((Mask & (LOCAL | REMOTE | PROTO)) != (LOCAL | REMOTE | PROTO)) {
  1506. ShellPrintHiiEx (
  1507. -1,
  1508. -1,
  1509. NULL,
  1510. STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_ONE_OF_PARAMETERS),
  1511. mHiiHandle,
  1512. mAppName,
  1513. L"--local --remote --proto"
  1514. );
  1515. return EFI_INVALID_PARAMETER;
  1516. }
  1517. OldData->SpdSelector = NewData->SpdSelector;
  1518. }
  1519. } else {
  1520. if ((Mask & LOCAL) != 0) {
  1521. OldData->SpdSelector->LocalAddressCount = NewData->SpdSelector->LocalAddressCount;
  1522. OldData->SpdSelector->LocalAddress = NewData->SpdSelector->LocalAddress;
  1523. }
  1524. if ((Mask & REMOTE) != 0) {
  1525. OldData->SpdSelector->RemoteAddressCount = NewData->SpdSelector->RemoteAddressCount;
  1526. OldData->SpdSelector->RemoteAddress = NewData->SpdSelector->RemoteAddress;
  1527. }
  1528. if ((Mask & PROTO) != 0) {
  1529. OldData->SpdSelector->NextLayerProtocol = NewData->SpdSelector->NextLayerProtocol;
  1530. }
  1531. if (OldData->SpdSelector != NULL) {
  1532. switch (OldData->SpdSelector->NextLayerProtocol) {
  1533. case EFI_IP4_PROTO_TCP:
  1534. case EFI_IP4_PROTO_UDP:
  1535. if ((Mask & LOCAL_PORT) != 0) {
  1536. OldData->SpdSelector->LocalPort = NewData->SpdSelector->LocalPort;
  1537. }
  1538. if ((Mask & REMOTE_PORT) != 0) {
  1539. OldData->SpdSelector->RemotePort = NewData->SpdSelector->RemotePort;
  1540. }
  1541. break;
  1542. case EFI_IP4_PROTO_ICMP:
  1543. if ((Mask & ICMP_TYPE) != 0) {
  1544. OldData->SpdSelector->LocalPort = (UINT8) NewData->SpdSelector->LocalPort;
  1545. }
  1546. if ((Mask & ICMP_CODE) != 0) {
  1547. OldData->SpdSelector->RemotePort = (UINT8) NewData->SpdSelector->RemotePort;
  1548. }
  1549. break;
  1550. }
  1551. }
  1552. }
  1553. return EFI_SUCCESS;
  1554. }
  1555. /**
  1556. Combine old PAD entry with new PAD entry.
  1557. @param[in, out] OldPadId The pointer to the EFI_IPSEC_PAD_ID structure.
  1558. @param[in, out] OldData The pointer to the EFI_IPSEC_PAD_DATA structure.
  1559. @param[in] NewPadId The pointer to the EFI_IPSEC_PAD_ID structure.
  1560. @param[in] NewData The pointer to the EFI_IPSEC_PAD_DATA structure.
  1561. @param[in] Mask The pointer to the Mask.
  1562. @param[out] CreateNew The switch to create new.
  1563. @retval EFI_SUCCESS Combined successfully.
  1564. @retval EFI_INVALID_PARAMETER Invalid user input parameter.
  1565. **/
  1566. EFI_STATUS
  1567. CombinePadEntry (
  1568. IN OUT EFI_IPSEC_PAD_ID *OldPadId,
  1569. IN OUT EFI_IPSEC_PAD_DATA *OldData,
  1570. IN EFI_IPSEC_PAD_ID *NewPadId,
  1571. IN EFI_IPSEC_PAD_DATA *NewData,
  1572. IN UINT32 Mask,
  1573. OUT BOOLEAN *CreateNew
  1574. )
  1575. {
  1576. *CreateNew = FALSE;
  1577. if ((Mask & (PEER_ID | PEER_ADDRESS)) == 0) {
  1578. CopyMem (NewPadId, OldPadId, sizeof (EFI_IPSEC_PAD_ID));
  1579. } else {
  1580. if ((Mask & PEER_ID) != 0) {
  1581. if (OldPadId->PeerIdValid) {
  1582. if (StrCmp ((CONST CHAR16 *) OldPadId->Id.PeerId, (CONST CHAR16 *) NewPadId->Id.PeerId) != 0) {
  1583. *CreateNew = TRUE;
  1584. }
  1585. } else {
  1586. *CreateNew = TRUE;
  1587. }
  1588. } else {
  1589. //
  1590. // MASK & PEER_ADDRESS
  1591. //
  1592. if (OldPadId->PeerIdValid) {
  1593. *CreateNew = TRUE;
  1594. } else {
  1595. if ((CompareMem (&OldPadId->Id.IpAddress.Address, &NewPadId->Id.IpAddress.Address, sizeof (EFI_IP_ADDRESS)) != 0) ||
  1596. (OldPadId->Id.IpAddress.PrefixLength != NewPadId->Id.IpAddress.PrefixLength)) {
  1597. *CreateNew = TRUE;
  1598. }
  1599. }
  1600. }
  1601. }
  1602. if ((Mask & AUTH_PROTO) != 0) {
  1603. OldData->AuthProtocol = NewData->AuthProtocol;
  1604. }
  1605. if ((Mask & AUTH_METHOD) != 0) {
  1606. OldData->AuthMethod = NewData->AuthMethod;
  1607. }
  1608. if ((Mask & IKE_ID) != 0) {
  1609. OldData->IkeIdFlag = NewData->IkeIdFlag;
  1610. }
  1611. if ((Mask & AUTH_DATA) != 0) {
  1612. OldData->AuthDataSize = NewData->AuthDataSize;
  1613. OldData->AuthData = NewData->AuthData;
  1614. }
  1615. if ((Mask & REVOCATION_DATA) != 0) {
  1616. OldData->RevocationDataSize = NewData->RevocationDataSize;
  1617. OldData->RevocationData = NewData->RevocationData;
  1618. }
  1619. return EFI_SUCCESS;
  1620. }
  1621. COMBINE_POLICY_ENTRY mCombinePolicyEntry[] = {
  1622. (COMBINE_POLICY_ENTRY) CombineSpdEntry,
  1623. (COMBINE_POLICY_ENTRY) CombineSadEntry,
  1624. (COMBINE_POLICY_ENTRY) CombinePadEntry
  1625. };
  1626. /**
  1627. Edit entry information in the database.
  1628. @param[in] Selector The pointer to the EFI_IPSEC_CONFIG_SELECTOR structure.
  1629. @param[in] Data The pointer to the data.
  1630. @param[in] Context The pointer to the INSERT_POLICY_ENTRY_CONTEXT structure.
  1631. @retval EFI_SUCCESS Continue the iteration.
  1632. @retval EFI_ABORTED Abort the iteration.
  1633. **/
  1634. EFI_STATUS
  1635. EditOperatePolicyEntry (
  1636. IN EFI_IPSEC_CONFIG_SELECTOR *Selector,
  1637. IN VOID *Data,
  1638. IN EDIT_POLICY_ENTRY_CONTEXT *Context
  1639. )
  1640. {
  1641. EFI_STATUS Status;
  1642. BOOLEAN CreateNew;
  1643. if (mMatchPolicyEntry[Context->DataType] (Selector, Data, &Context->Indexer)) {
  1644. ASSERT (Context->DataType < 3);
  1645. Status = mCombinePolicyEntry[Context->DataType] (
  1646. Selector,
  1647. Data,
  1648. Context->Selector,
  1649. Context->Data,
  1650. Context->Mask,
  1651. &CreateNew
  1652. );
  1653. if (!EFI_ERROR (Status)) {
  1654. //
  1655. // If the Selector already existed, this Entry will be updated by set data.
  1656. //
  1657. Status = mIpSecConfig->SetData (
  1658. mIpSecConfig,
  1659. Context->DataType,
  1660. Context->Selector, /// New created selector.
  1661. Data, /// Old date which has been modified, need to be set data.
  1662. Selector
  1663. );
  1664. ASSERT_EFI_ERROR (Status);
  1665. if (CreateNew) {
  1666. //
  1667. // Edit the entry to a new one. So, we need delete the old entry.
  1668. //
  1669. Status = mIpSecConfig->SetData (
  1670. mIpSecConfig,
  1671. Context->DataType,
  1672. Selector, /// Old selector.
  1673. NULL, /// NULL means to delete this Entry specified by Selector.
  1674. NULL
  1675. );
  1676. ASSERT_EFI_ERROR (Status);
  1677. }
  1678. }
  1679. Context->Status = Status;
  1680. return EFI_ABORTED;
  1681. }
  1682. return EFI_SUCCESS;
  1683. }
  1684. /**
  1685. Edit entry information in database according to datatype.
  1686. @param[in] DataType The value of EFI_IPSEC_CONFIG_DATA_TYPE.
  1687. @param[in] ParamPackage The pointer to the ParamPackage list.
  1688. @retval EFI_SUCCESS Edit entry information successfully.
  1689. @retval EFI_NOT_FOUND Can't find the specified entry.
  1690. @retval Others Some mistaken case.
  1691. **/
  1692. EFI_STATUS
  1693. EditPolicyEntry (
  1694. IN EFI_IPSEC_CONFIG_DATA_TYPE DataType,
  1695. IN LIST_ENTRY *ParamPackage
  1696. )
  1697. {
  1698. EFI_STATUS Status;
  1699. EDIT_POLICY_ENTRY_CONTEXT Context;
  1700. CONST CHAR16 *ValueStr;
  1701. ValueStr = ShellCommandLineGetValue (ParamPackage, L"-e");
  1702. if (ValueStr == NULL) {
  1703. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_INDEX_NOT_SPECIFIED), mHiiHandle, mAppName, ValueStr);
  1704. return EFI_NOT_FOUND;
  1705. }
  1706. Status = mConstructPolicyEntryIndexer[DataType] (&Context.Indexer, ParamPackage);
  1707. if (!EFI_ERROR (Status)) {
  1708. Context.DataType = DataType;
  1709. Context.Status = EFI_NOT_FOUND;
  1710. Status = mCreatePolicyEntry[DataType] (&Context.Selector, &Context.Data, ParamPackage, &Context.Mask, FALSE);
  1711. if (!EFI_ERROR (Status)) {
  1712. ForeachPolicyEntry (DataType, (VISIT_POLICY_ENTRY) EditOperatePolicyEntry, &Context);
  1713. Status = Context.Status;
  1714. }
  1715. if (Context.Selector != NULL) {
  1716. gBS->FreePool (Context.Selector);
  1717. }
  1718. if (Context.Data != NULL) {
  1719. gBS->FreePool (Context.Data);
  1720. }
  1721. }
  1722. if (Status == EFI_NOT_FOUND) {
  1723. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_INDEX_NOT_FOUND), mHiiHandle, mAppName, ValueStr);
  1724. } else if (EFI_ERROR (Status)) {
  1725. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_EDIT_FAILED), mHiiHandle, mAppName);
  1726. }
  1727. return Status;
  1728. }
  1729. /**
  1730. Insert entry information in database.
  1731. @param[in] Selector The pointer to the EFI_IPSEC_CONFIG_SELECTOR structure.
  1732. @param[in] Data The pointer to the data.
  1733. @param[in] Context The pointer to the INSERT_POLICY_ENTRY_CONTEXT structure.
  1734. @retval EFI_SUCCESS Continue the iteration.
  1735. @retval EFI_ABORTED Abort the iteration.
  1736. **/
  1737. EFI_STATUS
  1738. InsertPolicyEntry (
  1739. IN EFI_IPSEC_CONFIG_SELECTOR *Selector,
  1740. IN VOID *Data,
  1741. IN INSERT_POLICY_ENTRY_CONTEXT *Context
  1742. )
  1743. {
  1744. //
  1745. // Found the entry which we want to insert before.
  1746. //
  1747. if (mMatchPolicyEntry[Context->DataType] (Selector, Data, &Context->Indexer)) {
  1748. Context->Status = mIpSecConfig->SetData (
  1749. mIpSecConfig,
  1750. Context->DataType,
  1751. Context->Selector,
  1752. Context->Data,
  1753. Selector
  1754. );
  1755. //
  1756. // Abort the iteration after the insertion.
  1757. //
  1758. return EFI_ABORTED;
  1759. }
  1760. return EFI_SUCCESS;
  1761. }
  1762. /**
  1763. Insert or add entry information in database according to datatype.
  1764. @param[in] DataType The value of EFI_IPSEC_CONFIG_DATA_TYPE.
  1765. @param[in] ParamPackage The pointer to the ParamPackage list.
  1766. @retval EFI_SUCCESS Insert or add entry information successfully.
  1767. @retval EFI_NOT_FOUND Can't find the specified entry.
  1768. @retval EFI_BUFFER_TOO_SMALL The entry already existed.
  1769. @retval EFI_UNSUPPORTED The operation is not supported.
  1770. @retval Others Some mistaken case.
  1771. **/
  1772. EFI_STATUS
  1773. AddOrInsertPolicyEntry (
  1774. IN EFI_IPSEC_CONFIG_DATA_TYPE DataType,
  1775. IN LIST_ENTRY *ParamPackage
  1776. )
  1777. {
  1778. EFI_STATUS Status;
  1779. EFI_IPSEC_CONFIG_SELECTOR *Selector;
  1780. VOID *Data;
  1781. INSERT_POLICY_ENTRY_CONTEXT Context;
  1782. UINT32 Mask;
  1783. UINTN DataSize;
  1784. CONST CHAR16 *ValueStr;
  1785. Status = mCreatePolicyEntry[DataType] (&Selector, &Data, ParamPackage, &Mask, TRUE);
  1786. if (!EFI_ERROR (Status)) {
  1787. //
  1788. // Find if the Selector to be inserted already exists.
  1789. //
  1790. DataSize = 0;
  1791. Status = mIpSecConfig->GetData (
  1792. mIpSecConfig,
  1793. DataType,
  1794. Selector,
  1795. &DataSize,
  1796. NULL
  1797. );
  1798. if (Status == EFI_BUFFER_TOO_SMALL) {
  1799. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_ALREADY_EXISTS), mHiiHandle, mAppName);
  1800. } else if (ShellCommandLineGetFlag (ParamPackage, L"-a")) {
  1801. Status = mIpSecConfig->SetData (
  1802. mIpSecConfig,
  1803. DataType,
  1804. Selector,
  1805. Data,
  1806. NULL
  1807. );
  1808. } else {
  1809. ValueStr = ShellCommandLineGetValue (ParamPackage, L"-i");
  1810. if (ValueStr == NULL) {
  1811. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_INDEX_NOT_SPECIFIED), mHiiHandle, mAppName, ValueStr);
  1812. return EFI_NOT_FOUND;
  1813. }
  1814. Status = mConstructPolicyEntryIndexer[DataType] (&Context.Indexer, ParamPackage);
  1815. if (!EFI_ERROR (Status)) {
  1816. Context.DataType = DataType;
  1817. Context.Status = EFI_NOT_FOUND;
  1818. Context.Selector = Selector;
  1819. Context.Data = Data;
  1820. ForeachPolicyEntry (DataType, (VISIT_POLICY_ENTRY) InsertPolicyEntry, &Context);
  1821. Status = Context.Status;
  1822. if (Status == EFI_NOT_FOUND) {
  1823. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_INDEX_NOT_FOUND), mHiiHandle, mAppName, ValueStr);
  1824. }
  1825. }
  1826. }
  1827. gBS->FreePool (Selector);
  1828. gBS->FreePool (Data);
  1829. }
  1830. if (Status == EFI_UNSUPPORTED) {
  1831. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_INSERT_UNSUPPORT), mHiiHandle, mAppName);
  1832. } else if (EFI_ERROR (Status)) {
  1833. ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_IPSEC_CONFIG_INSERT_FAILED), mHiiHandle, mAppName);
  1834. }
  1835. return Status;
  1836. }