summaryrefslogtreecommitdiff
path: root/NetworkPkg
diff options
context:
space:
mode:
authorJiaxin Wu <jiaxin.wu@intel.com>2016-08-15 11:27:59 +0800
committerJiaxin Wu <jiaxin.wu@intel.com>2016-08-18 16:53:14 +0800
commit40b83d6114f55ed975d9d632f0cd9679781c64e0 (patch)
tree7ede5bb1ffe17e9627871a329cab3e67f92bdd3a /NetworkPkg
parentefe3f0099c0b986a01c2e8c7ca8ceacedcc965ba (diff)
downloadedk2-platforms-40b83d6114f55ed975d9d632f0cd9679781c64e0.tar.xz
NetworkPkg/IpSecDxe: Fix UEFI IKE Initial Exchange failure
*v2: update the commit log. IKE Initial Exchange message should cover below process: Initiator Responder Message1 HDR,SAil,KEi,Ni ------> Message2 <------ HDR,SArl,KEr,Nr,[CERTREQ] Message3 HDR,SK{} ------> Message4 <------ HDR,SK{} If Initial Exchange message is initiated by Linux IKE, it works well. But the failure will happen if it's initiated by UEFI IKE. This issue is caused by the no status check of NotifyCookiePayload. While parsing the IKEv2 packet for IKE_SA_INIT exchange, if the packet doesn't contain COOKIE Notify payload, EFI_INVALID_PARAMETER will be returned from Ikev2ParserNotifyCookiePayload(). Current implementation return this error status directly, then the session will be broken. The correct behavior should check this status. If no COOKIE Notify payload, initiator don't need to retry the IKE_SA_INIT. Cc: Ye Ting <ting.ye@intel.com> Cc: Fu Siyuan <siyuan.fu@intel.com> Cc: Zhang Lubo <lubo.zhang@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com>
Diffstat (limited to 'NetworkPkg')
-rw-r--r--NetworkPkg/IpSecDxe/Ikev2/Sa.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/NetworkPkg/IpSecDxe/Ikev2/Sa.c b/NetworkPkg/IpSecDxe/Ikev2/Sa.c
index 4cbfac33b1..f9421ed4e8 100644
--- a/NetworkPkg/IpSecDxe/Ikev2/Sa.c
+++ b/NetworkPkg/IpSecDxe/Ikev2/Sa.c
@@ -287,9 +287,8 @@ Ikev2InitPskParser (
// as first payload and all other payloads unchanged.
//
if (IkeSaSession->SessionCommon.IsInitiator) {
- if (NotifyPayload != NULL) {
- Status = Ikev2ParserNotifyCookiePayload (NotifyPayload, IkeSaSession);
- return Status;
+ if (NotifyPayload != NULL && !EFI_ERROR(Ikev2ParserNotifyCookiePayload (NotifyPayload, IkeSaSession))) {
+ return EFI_SUCCESS;
}
}