From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by ml01.01.org (Postfix) with ESMTP id 65E4B1A1E01 for ; Wed, 17 Aug 2016 23:38:52 -0700 (PDT) Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga101.jf.intel.com with ESMTP; 17 Aug 2016 23:38:52 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.28,538,1464678000"; d="scan'208";a="1016455100" Received: from jiaxinwu-mobl2.ccr.corp.intel.com ([10.239.196.62]) by orsmga001.jf.intel.com with ESMTP; 17 Aug 2016 23:38:31 -0700 From: Jiaxin Wu To: edk2-devel@lists.01.org Cc: Ye Ting , Fu Siyuan , Zhang Lubo Date: Thu, 18 Aug 2016 14:38:27 +0800 Message-Id: <1471502308-42296-2-git-send-email-jiaxin.wu@intel.com> X-Mailer: git-send-email 1.9.5.msysgit.1 In-Reply-To: <1471502308-42296-1-git-send-email-jiaxin.wu@intel.com> References: <1471502308-42296-1-git-send-email-jiaxin.wu@intel.com> Subject: [PATCH v2 1/2] NetworkPkg/IpSecDxe: Fix UEFI IKE Initial Exchange failure X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Aug 2016 06:38:52 -0000 *v2: update the commit log. IKE Initial Exchange message should cover below process: Initiator Responder Message1 HDR,SAil,KEi,Ni ------> Message2 <------ HDR,SArl,KEr,Nr,[CERTREQ] Message3 HDR,SK{} ------> Message4 <------ HDR,SK{} If Initial Exchange message is initiated by Linux IKE, it works well. But the failure will happen if it's initiated by UEFI IKE. This issue is caused by the no status check of NotifyCookiePayload. While parsing the IKEv2 packet for IKE_SA_INIT exchange, if the packet doesn't contain COOKIE Notify payload, EFI_INVALID_PARAMETER will be returned from Ikev2ParserNotifyCookiePayload(). Current implementation return this error status directly, then the session will be broken. The correct behavior should check this status. If no COOKIE Notify payload, initiator don't need to retry the IKE_SA_INIT. Cc: Ye Ting Cc: Fu Siyuan Cc: Zhang Lubo Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Jiaxin Wu --- NetworkPkg/IpSecDxe/Ikev2/Sa.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/NetworkPkg/IpSecDxe/Ikev2/Sa.c b/NetworkPkg/IpSecDxe/Ikev2/Sa.c index 4cbfac3..f9421ed 100644 --- a/NetworkPkg/IpSecDxe/Ikev2/Sa.c +++ b/NetworkPkg/IpSecDxe/Ikev2/Sa.c @@ -285,13 +285,12 @@ Ikev2InitPskParser ( // payload with the cookie data, initiator MUST retry the IKE_SA_INIT with a // Notify payload of type COOKIE containing the responder suppplied cookie data // as first payload and all other payloads unchanged. // if (IkeSaSession->SessionCommon.IsInitiator) { - if (NotifyPayload != NULL) { - Status = Ikev2ParserNotifyCookiePayload (NotifyPayload, IkeSaSession); - return Status; + if (NotifyPayload != NULL && !EFI_ERROR(Ikev2ParserNotifyCookiePayload (NotifyPayload, IkeSaSession))) { + return EFI_SUCCESS; } } if ((KeyPayload == NULL) || (SaPayload == NULL) || (NoncePayload == NULL)) { return EFI_INVALID_PARAMETER; -- 1.9.5.msysgit.1