1 /** @file 2 EFI IPsec Configuration Protocol Definition 3 The EFI_IPSEC_CONFIG_PROTOCOL provides the mechanism to set and retrieve security and 4 policy related information for the EFI IPsec protocol driver. 5 6 Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR> 7 This program and the accompanying materials 8 are licensed and made available under the terms and conditions of the BSD License 9 which accompanies this distribution. The full text of the license may be found at 10 http://opensource.org/licenses/bsd-license.php 11 12 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, 13 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. 14 15 @par Revision Reference: 16 This Protocol is introduced in UEFI Specification 2.2 17 18 **/ 19 20 #ifndef __EFI_IPSE_CCONFIG_PROTOCOL_H__ 21 #define __EFI_IPSE_CCONFIG_PROTOCOL_H__ 22 23 24 #define EFI_IPSEC_CONFIG_PROTOCOL_GUID \ 25 { \ 26 0xce5e5929, 0xc7a3, 0x4602, {0xad, 0x9e, 0xc9, 0xda, 0xf9, 0x4e, 0xbf, 0xcf } \ 27 } 28 29 typedef struct _EFI_IPSEC_CONFIG_PROTOCOL EFI_IPSEC_CONFIG_PROTOCOL; 30 31 /// 32 /// EFI_IPSEC_CONFIG_DATA_TYPE 33 /// 34 typedef enum { 35 /// 36 /// The IPsec Security Policy Database (aka SPD) setting. In IPsec, 37 /// an essential element of Security Association (SA) processing is 38 /// underlying SPD that specifies what services are to be offered to 39 /// IP datagram and in what fashion. The SPD must be consulted 40 /// during the processing of all traffic (inbound and outbound), 41 /// including traffic not protected by IPsec, that traverses the IPsec 42 /// boundary. With this DataType, SetData() function is to set 43 /// the SPD entry information, which may add one new entry, delete 44 /// one existed entry or flush the whole database according to the 45 /// parameter values. The corresponding Data is of type 46 /// EFI_IPSEC_SPD_DATA 47 /// 48 IPsecConfigDataTypeSpd, 49 /// 50 /// The IPsec Security Association Database (aka SAD) setting. A 51 /// SA is a simplex connection that affords security services to the 52 /// traffic carried by it. Security services are afforded to an SA by the 53 /// use of AH, or ESP, but not both. The corresponding Data is of 54 /// type EFI_IPSEC_SAD_DATA. 55 /// 56 IPsecConfigDataTypeSad, 57 /// 58 /// The IPsec Peer Authorization Database (aka PAD) setting, which 59 /// provides the link between the SPD and a security association 60 /// management protocol. The PAD entry specifies the 61 /// authentication protocol (e.g. IKEv1, IKEv2) method used and the 62 /// authentication data. The corresponding Data is of type 63 /// EFI_IPSEC_PAD_DATA. 64 /// 65 IPsecConfigDataTypePad, 66 IPsecConfigDataTypeMaximum 67 } EFI_IPSEC_CONFIG_DATA_TYPE; 68 69 /// 70 /// EFI_IP_ADDRESS_INFO 71 /// 72 typedef struct _EFI_IP_ADDRESS_INFO { 73 EFI_IP_ADDRESS Address; ///< The IPv4 or IPv6 address 74 UINT8 PrefixLength; ///< The length of the prefix associated with the Address. 75 } EFI_IP_ADDRESS_INFO; 76 77 78 /// 79 /// EFI_IPSEC_SPD_SELECTOR 80 /// 81 typedef struct _EFI_IPSEC_SPD_SELECTOR { 82 /// 83 /// Specifies the actual number of entries in LocalAddress. 84 /// 85 UINT32 LocalAddressCount; 86 /// 87 /// A list of ranges of IPv4 or IPv6 addresses, which refers to the 88 /// addresses being protected by IPsec policy. 89 /// 90 EFI_IP_ADDRESS_INFO *LocalAddress; 91 /// 92 /// Specifies the actual number of entries in RemoteAddress. 93 /// 94 UINT32 RemoteAddressCount; 95 /// 96 /// A list of ranges of IPv4 or IPv6 addresses, which are peer entities 97 /// to LocalAddress. 98 /// 99 EFI_IP_ADDRESS_INFO *RemoteAddress; 100 /// 101 /// Next layer protocol. Obtained from the IPv4 Protocol or the IPv6 102 /// Next Header fields. The next layer protocol is whatever comes 103 /// after any IP extension headers that are present. A zero value is a 104 /// wildcard that matches any value in NextLayerProtocol field. 105 /// 106 UINT16 NextLayerProtocol; 107 /// 108 /// Local Port if the Next Layer Protocol uses two ports (as do TCP, 109 /// UDP, and others). A zero value is a wildcard that matches any 110 /// value in LocalPort field. 111 /// 112 UINT16 LocalPort; 113 /// 114 /// A designed port range size. The start port is LocalPort, and 115 /// the total number of ports is described by LocalPortRange. 116 /// This field is ignored if NextLayerProtocol does not use 117 /// ports. 118 /// 119 UINT16 LocalPortRange; 120 /// 121 /// Remote Port if the Next Layer Protocol uses two ports. A zero 122 /// value is a wildcard that matches any value in RemotePort field. 123 /// 124 UINT16 RemotePort; 125 /// 126 /// A designed port range size. The start port is RemotePort, and 127 /// the total number of ports is described by RemotePortRange. 128 /// This field is ignored if NextLayerProtocol does not use ports. 129 /// 130 UINT16 RemotePortRange; 131 } EFI_IPSEC_SPD_SELECTOR; 132 133 /// 134 /// EFI_IPSEC_TRAFFIC_DIR 135 /// represents the directionality in an SPD entry. 136 /// 137 typedef enum { 138 /// 139 /// The EfiIPsecInBound refers to traffic entering an IPsec implementation via 140 /// the unprotected interface or emitted by the implementation on the unprotected 141 /// side of the boundary and directed towards the protected interface. 142 /// 143 EfiIPsecInBound, 144 /// 145 /// The EfiIPsecOutBound refers to traffic entering the implementation via 146 /// the protected interface, or emitted by the implementation on the protected side 147 /// of the boundary and directed toward the unprotected interface. 148 /// 149 EfiIPsecOutBound 150 } EFI_IPSEC_TRAFFIC_DIR; 151 152 /// 153 /// EFI_IPSEC_ACTION 154 /// represents three possible processing choices. 155 /// 156 typedef enum { 157 /// 158 /// Refers to traffic that is not allowed to traverse the IPsec boundary. 159 /// 160 EfiIPsecActionDiscard, 161 /// 162 /// Refers to traffic that is allowed to cross the IPsec boundary 163 /// without protection. 164 /// 165 EfiIPsecActionBypass, 166 /// 167 /// Refers to traffic that is afforded IPsec protection, and for such 168 /// traffic the SPD must specify the security protocols to be 169 /// employed, their mode, security service options, and the 170 /// cryptographic algorithms to be used. 171 /// 172 EfiIPsecActionProtect 173 } EFI_IPSEC_ACTION; 174 175 /// 176 /// EFI_IPSEC_SA_LIFETIME 177 /// defines the lifetime of an SA, which represents when a SA must be 178 /// replaced or terminated. A value of all 0 for each field removes 179 /// the limitation of a SA lifetime. 180 /// 181 typedef struct _EFI_IPSEC_SA_LIFETIME { 182 /// 183 /// The number of bytes to which the IPsec cryptographic algorithm 184 /// can be applied. For ESP, this is the encryption algorithm and for 185 /// AH, this is the authentication algorithm. The ByteCount 186 /// includes pad bytes for cryptographic operations. 187 /// 188 UINT64 ByteCount; 189 /// 190 /// A time interval in second that warns the implementation to 191 /// initiate action such as setting up a replacement SA. 192 /// 193 UINT64 SoftLifetime; 194 /// 195 /// A time interval in second when the current SA ends and is 196 /// destroyed. 197 /// 198 UINT64 HardLifetime; 199 } EFI_IPSEC_SA_LIFETIME; 200 201 /// 202 /// EFI_IPSEC_MODE 203 /// There are two modes of IPsec operation: transport mode and tunnel mode. In 204 /// EfiIPsecTransport mode, AH and ESP provide protection primarily for next layer protocols; 205 /// In EfiIPsecTunnel mode, AH and ESP are applied to tunneled IP packets. 206 /// 207 typedef enum { 208 EfiIPsecTransport, 209 EfiIPsecTunnel 210 } EFI_IPSEC_MODE; 211 212 /// 213 /// EFI_IPSEC_TUNNEL_DF_OPTION 214 /// The option of copying the DF bit from an outbound package to 215 /// the tunnel mode header that it emits, when traffic is carried 216 /// via a tunnel mode SA. This applies to SAs where both inner and 217 /// outer headers are IPv4. 218 /// 219 typedef enum { 220 EfiIPsecTunnelClearDf, ///< Clear DF bit from inner header. 221 EfiIPsecTunnelSetDf, ///< Set DF bit from inner header. 222 EfiIPsecTunnelCopyDf ///< Copy DF bit from inner header. 223 } EFI_IPSEC_TUNNEL_DF_OPTION; 224 225 /// 226 /// EFI_IPSEC_TUNNEL_OPTION 227 /// 228 typedef struct _EFI_IPSEC_TUNNEL_OPTION { 229 /// 230 /// Local tunnel address when IPsec mode is EfiIPsecTunnel. 231 /// 232 EFI_IP_ADDRESS LocalTunnelAddress; 233 /// 234 /// Remote tunnel address when IPsec mode is EfiIPsecTunnel. 235 /// 236 EFI_IP_ADDRESS RemoteTunnelAddress; 237 /// 238 /// The option of copying the DF bit from an outbound package 239 /// to the tunnel mode header that it emits, when traffic is 240 /// carried via a tunnel mode SA. 241 /// 242 EFI_IPSEC_TUNNEL_DF_OPTION DF; 243 } EFI_IPSEC_TUNNEL_OPTION; 244 245 /// 246 /// EFI_IPSEC_PROTOCOL_TYPE 247 /// 248 typedef enum { 249 EfiIPsecAH, ///< IP Authentication Header protocol which is specified in RFC 4302. 250 EfiIPsecESP ///< IP Encapsulating Security Payload which is specified in RFC 4303. 251 } EFI_IPSEC_PROTOCOL_TYPE; 252 253 /// 254 /// EFI_IPSEC_PROCESS_POLICY 255 /// describes a policy list for traffic processing. 256 /// 257 typedef struct _EFI_IPSEC_PROCESS_POLICY { 258 /// 259 /// Extended Sequence Number. Is this SA using extended sequence 260 /// numbers. 64 bit counter is used if TRUE. 261 /// 262 BOOLEAN ExtSeqNum; 263 /// 264 /// A flag indicating whether overflow of the sequence number 265 /// counter should generate an auditable event and prevent 266 /// transmission of additional packets on the SA, or whether rollover 267 /// is permitted. 268 /// 269 BOOLEAN SeqOverflow; 270 /// 271 /// Is this SA using stateful fragment checking. TRUE represents 272 /// stateful fragment checking. 273 /// 274 BOOLEAN FragCheck; 275 /// 276 /// A time interval after which a SA must be replaced with a new SA 277 /// (and new SPI) or terminated. 278 /// 279 EFI_IPSEC_SA_LIFETIME SaLifetime; 280 /// 281 /// IPsec mode: tunnel or transport. 282 /// 283 EFI_IPSEC_MODE Mode; 284 /// 285 /// Tunnel Option. TunnelOption is ignored if Mode is EfiIPsecTransport. 286 /// 287 EFI_IPSEC_TUNNEL_OPTION *TunnelOption; 288 /// 289 /// IPsec protocol: AH or ESP 290 /// 291 EFI_IPSEC_PROTOCOL_TYPE Proto; 292 /// 293 /// Cryptographic algorithm type used for authentication. 294 /// 295 UINT8 AuthAlgoId; 296 /// 297 /// Cryptographic algorithm type used for encryption. EncAlgo is 298 /// NULL when IPsec protocol is AH. For ESP protocol, EncAlgo 299 /// can also be used to describe the algorithm if a combined mode 300 /// algorithm is used. 301 /// 302 UINT8 EncAlgoId; 303 } EFI_IPSEC_PROCESS_POLICY; 304 305 /// 306 /// EFI_IPSEC_SA_ID 307 /// A triplet to identify an SA, consisting of the following members. 308 /// 309 typedef struct _EFI_IPSEC_SA_ID { 310 /// 311 /// Security Parameter Index (aka SPI). An arbitrary 32-bit value 312 /// that is used by a receiver to identity the SA to which an incoming 313 /// package should be bound. 314 /// 315 UINT32 Spi; 316 /// 317 /// IPsec protocol: AH or ESP 318 /// 319 EFI_IPSEC_PROTOCOL_TYPE Proto; 320 /// 321 /// Destination IP address. 322 /// 323 EFI_IP_ADDRESS DestAddress; 324 } EFI_IPSEC_SA_ID; 325 326 327 #define MAX_PEERID_LEN 128 328 329 /// 330 /// EFI_IPSEC_SPD_DATA 331 /// 332 typedef struct _EFI_IPSEC_SPD_DATA { 333 /// 334 /// A null-terminated ASCII name string which is used as a symbolic 335 /// identifier for an IPsec Local or Remote address. 336 /// 337 UINT8 Name[MAX_PEERID_LEN]; 338 /// 339 /// Bit-mapped list describing Populate from Packet flags. When 340 /// creating a SA, if PackageFlag bit is set to TRUE, instantiate 341 /// the selector from the corresponding field in the package that 342 /// triggered the creation of the SA, else from the value(s) in the 343 /// corresponding SPD entry. The PackageFlag bit setting for 344 /// corresponding selector field of EFI_IPSEC_SPD_SELECTOR: 345 /// Bit 0: EFI_IPSEC_SPD_SELECTOR.LocalAddress 346 /// Bit 1: EFI_IPSEC_SPD_SELECTOR.RemoteAddress 347 /// Bit 2: 348 /// EFI_IPSEC_SPD_SELECTOR.NextLayerProtocol 349 /// Bit 3: EFI_IPSEC_SPD_SELECTOR.LocalPort 350 /// Bit 4: EFI_IPSEC_SPD_SELECTOR.RemotePort 351 /// Others: Reserved. 352 /// 353 UINT32 PackageFlag; 354 /// 355 /// The traffic direction of data gram. 356 /// 357 EFI_IPSEC_TRAFFIC_DIR TrafficDirection; 358 /// 359 /// Processing choices to indicate which action is required by this 360 /// policy. 361 /// 362 EFI_IPSEC_ACTION Action; 363 /// 364 /// The policy and rule information for a SPD entry. 365 /// 366 EFI_IPSEC_PROCESS_POLICY *ProcessingPolicy; 367 /// 368 /// Specifies the actual number of entries in SaId list. 369 /// 370 UINTN SaIdCount; 371 /// 372 /// The SAD entry used for the traffic processing. The 373 /// existed SAD entry links indicate this is the manual key case. 374 /// 375 EFI_IPSEC_SA_ID SaId[1]; 376 } EFI_IPSEC_SPD_DATA; 377 378 /// 379 /// EFI_IPSEC_AH_ALGO_INFO 380 /// The security algorithm selection for IPsec AH authentication. 381 /// The required authentication algorithm is specified in RFC 4305. 382 /// 383 typedef struct _EFI_IPSEC_AH_ALGO_INFO { 384 UINT8 AuthAlgoId; 385 UINTN AuthKeyLength; 386 VOID *AuthKey; 387 } EFI_IPSEC_AH_ALGO_INFO; 388 389 /// 390 /// EFI_IPSEC_ESP_ALGO_INFO 391 /// The security algorithm selection for IPsec ESP encryption and authentication. 392 /// The required authentication algorithm is specified in RFC 4305. 393 /// EncAlgoId fields can also specify an ESP combined mode algorithm 394 /// (e.g. AES with CCM mode, specified in RFC 4309), which provides both 395 /// confidentiality and authentication services. 396 /// 397 typedef struct _EFI_IPSEC_ESP_ALGO_INFO { 398 UINT8 EncAlgoId; 399 UINTN EncKeyLength; 400 VOID *EncKey; 401 UINT8 AuthAlgoId; 402 UINTN AuthKeyLength; 403 VOID *AuthKey; 404 } EFI_IPSEC_ESP_ALGO_INFO; 405 406 /// 407 /// EFI_IPSEC_ALGO_INFO 408 /// 409 typedef union { 410 EFI_IPSEC_AH_ALGO_INFO AhAlgoInfo; 411 EFI_IPSEC_ESP_ALGO_INFO EspAlgoInfo; 412 } EFI_IPSEC_ALGO_INFO; 413 414 /// 415 /// EFI_IPSEC_SA_DATA 416 /// 417 typedef struct _EFI_IPSEC_SA_DATA { 418 /// 419 /// IPsec mode: tunnel or transport. 420 /// 421 EFI_IPSEC_MODE Mode; 422 /// 423 /// Sequence Number Counter. A 64-bit counter used to generate the 424 /// sequence number field in AH or ESP headers. 425 /// 426 UINT64 SNCount; 427 /// 428 /// Anti-Replay Window. A 64-bit counter and a bit-map used to 429 /// determine whether an inbound AH or ESP packet is a replay. 430 /// 431 UINT8 AntiReplayWindows; 432 /// 433 /// AH/ESP cryptographic algorithm, key and parameters. 434 /// 435 EFI_IPSEC_ALGO_INFO AlgoInfo; 436 /// 437 /// Lifetime of this SA. 438 /// 439 EFI_IPSEC_SA_LIFETIME SaLifetime; 440 /// 441 /// Any observed path MTU and aging variables. The Path MTU 442 /// processing is defined in section 8 of RFC 4301. 443 /// 444 UINT32 PathMTU; 445 /// 446 /// Link to one SPD entry. 447 /// 448 EFI_IPSEC_SPD_SELECTOR *SpdSelector; 449 /// 450 /// Indication of whether it's manually set or negotiated automatically. 451 /// If ManualSet is FALSE, the corresponding SA entry is inserted through 452 /// IKE protocol negotiation. 453 /// 454 BOOLEAN ManualSet; 455 } EFI_IPSEC_SA_DATA; 456 457 /// 458 /// EFI_IPSEC_SA_DATA2 459 /// 460 typedef struct _EFI_IPSEC_SA_DATA2 { 461 /// 462 /// IPsec mode: tunnel or transport 463 /// 464 EFI_IPSEC_MODE Mode; 465 /// 466 /// Sequence Number Counter. A 64-bit counter used to generate the sequence 467 /// number field in AH or ESP headers. 468 /// 469 UINT64 SNCount; 470 /// 471 /// Anti-Replay Window. A 64-bit counter and a bit-map used to determine 472 /// whether an inbound AH or ESP packet is a replay. 473 /// 474 UINT8 AntiReplayWindows; 475 /// 476 /// AH/ESP cryptographic algorithm, key and parameters. 477 /// 478 EFI_IPSEC_ALGO_INFO AlgoInfo; 479 /// 480 /// Lifetime of this SA. 481 /// 482 EFI_IPSEC_SA_LIFETIME SaLifetime; 483 /// 484 /// Any observed path MTU and aging variables. The Path MTU processing is 485 /// defined in section 8 of RFC 4301. 486 /// 487 UINT32 PathMTU; 488 /// 489 /// Link to one SPD entry 490 /// 491 EFI_IPSEC_SPD_SELECTOR *SpdSelector; 492 /// 493 /// Indication of whether it's manually set or negotiated automatically. 494 /// If ManualSet is FALSE, the corresponding SA entry is inserted through IKE 495 /// protocol negotiation 496 /// 497 BOOLEAN ManualSet; 498 /// 499 /// The tunnel header IP source address. 500 /// 501 EFI_IP_ADDRESS TunnelSourceAddress; 502 /// 503 /// The tunnel header IP destination address. 504 /// 505 EFI_IP_ADDRESS TunnelDestinationAddress; 506 } EFI_IPSEC_SA_DATA2; 507 508 509 /// 510 /// EFI_IPSEC_PAD_ID 511 /// specifies the identifier for PAD entry, which is also used for SPD lookup. 512 /// IpAddress Pointer to the IPv4 or IPv6 address range. 513 /// 514 typedef struct _EFI_IPSEC_PAD_ID { 515 /// 516 /// Flag to identify which type of PAD Id is used. 517 /// 518 BOOLEAN PeerIdValid; 519 union { 520 /// 521 /// Pointer to the IPv4 or IPv6 address range. 522 /// 523 EFI_IP_ADDRESS_INFO IpAddress; 524 /// 525 /// Pointer to a null terminated ASCII string 526 /// representing the symbolic names. A PeerId can be a DNS 527 /// name, Distinguished Name, RFC 822 email address or Key ID 528 /// (specified in section 4.4.3.1 of RFC 4301) 529 /// 530 UINT8 PeerId[MAX_PEERID_LEN]; 531 } Id; 532 } EFI_IPSEC_PAD_ID; 533 534 /// 535 /// EFI_IPSEC_CONFIG_SELECTOR 536 /// describes the expected IPsec configuration data selector 537 /// of type EFI_IPSEC_CONFIG_DATA_TYPE. 538 /// 539 typedef union { 540 EFI_IPSEC_SPD_SELECTOR SpdSelector; 541 EFI_IPSEC_SA_ID SaId; 542 EFI_IPSEC_PAD_ID PadId; 543 } EFI_IPSEC_CONFIG_SELECTOR; 544 545 /// 546 /// EFI_IPSEC_AUTH_PROTOCOL_TYPE 547 /// defines the possible authentication protocol for IPsec 548 /// security association management. 549 /// 550 typedef enum { 551 EfiIPsecAuthProtocolIKEv1, 552 EfiIPsecAuthProtocolIKEv2, 553 EfiIPsecAuthProtocolMaximum 554 } EFI_IPSEC_AUTH_PROTOCOL_TYPE; 555 556 /// 557 /// EFI_IPSEC_AUTH_METHOD 558 /// 559 typedef enum { 560 /// 561 /// Using Pre-shared Keys for manual security associations. 562 /// 563 EfiIPsecAuthMethodPreSharedSecret, 564 /// 565 /// IKE employs X.509 certificates for SA establishment. 566 /// 567 EfiIPsecAuthMethodCertificates, 568 EfiIPsecAuthMethodMaximum 569 } EFI_IPSEC_AUTH_METHOD; 570 571 /// 572 /// EFI_IPSEC_PAD_DATA 573 /// 574 typedef struct _EFI_IPSEC_PAD_DATA { 575 /// 576 /// Authentication Protocol for IPsec security association management. 577 /// 578 EFI_IPSEC_AUTH_PROTOCOL_TYPE AuthProtocol; 579 /// 580 /// Authentication method used. 581 /// 582 EFI_IPSEC_AUTH_METHOD AuthMethod; 583 /// 584 /// The IKE ID payload will be used as a symbolic name for SPD 585 /// lookup if IkeIdFlag is TRUE. Otherwise, the remote IP 586 /// address provided in traffic selector playloads will be used. 587 /// 588 BOOLEAN IkeIdFlag; 589 /// 590 /// The size of Authentication data buffer, in bytes. 591 /// 592 UINTN AuthDataSize; 593 /// 594 /// Buffer for Authentication data, (e.g., the pre-shared secret or the 595 /// trust anchor relative to which the peer's certificate will be 596 /// validated). 597 /// 598 VOID *AuthData; 599 /// 600 /// The size of RevocationData, in bytes 601 /// 602 UINTN RevocationDataSize; 603 /// 604 /// Pointer to CRL or OCSP data, if certificates are used for 605 /// authentication method. 606 /// 607 VOID *RevocationData; 608 } EFI_IPSEC_PAD_DATA; 609 610 611 /** 612 Set the security association, security policy and peer authorization configuration 613 information for the EFI IPsec driver. 614 615 This function is used to set the IPsec configuration information of type DataType for 616 the EFI IPsec driver. 617 The IPsec configuration data has a unique selector/identifier separately to identify 618 a data entry. The selector structure depends on DataType's definition. 619 Using SetData() with a Data of NULL causes the IPsec configuration data entry identified 620 by DataType and Selector to be deleted. 621 622 @param[in] This Pointer to the EFI_IPSEC_CONFIG_PROTOCOL instance. 623 @param[in] DataType The type of data to be set. 624 @param[in] Selector Pointer to an entry selector on operated configuration data 625 specified by DataType. A NULL Selector causes the entire 626 specified-type configuration information to be flushed. 627 @param[in] Data The data buffer to be set. The structure of the data buffer is 628 associated with the DataType. 629 @param[in] InsertBefore Pointer to one entry selector which describes the expected 630 position the new data entry will be added. If InsertBefore is NULL, 631 the new entry will be appended the end of database. 632 633 @retval EFI_SUCCESS The specified configuration entry data is set successfully. 634 @retval EFI_INVALID_PARAMETER One or more of the following are TRUE: 635 - This is NULL. 636 @retval EFI_UNSUPPORTED The specified DataType is not supported. 637 @retval EFI_OUT_OF_RESOURCED The required system resource could not be allocated. 638 639 **/ 640 typedef 641 EFI_STATUS 642 (EFIAPI *EFI_IPSEC_CONFIG_SET_DATA)( 643 IN EFI_IPSEC_CONFIG_PROTOCOL *This, 644 IN EFI_IPSEC_CONFIG_DATA_TYPE DataType, 645 IN EFI_IPSEC_CONFIG_SELECTOR *Selector, 646 IN VOID *Data, 647 IN EFI_IPSEC_CONFIG_SELECTOR *InsertBefore OPTIONAL 648 ); 649 650 /** 651 Return the configuration value for the EFI IPsec driver. 652 653 This function lookup the data entry from IPsec database or IKEv2 configuration 654 information. The expected data type and unique identification are described in 655 DataType and Selector parameters. 656 657 @param[in] This Pointer to the EFI_IPSEC_CONFIG_PROTOCOL instance. 658 @param[in] DataType The type of data to retrieve. 659 @param[in] Selector Pointer to an entry selector which is an identifier of the IPsec 660 configuration data entry. 661 @param[in, out] DataSize On output the size of data returned in Data. 662 @param[out] Data The buffer to return the contents of the IPsec configuration data. 663 The type of the data buffer is associated with the DataType. 664 665 @retval EFI_SUCCESS The specified configuration data is got successfully. 666 @retval EFI_INVALID_PARAMETER One or more of the followings are TRUE: 667 - This is NULL. 668 - Selector is NULL. 669 - DataSize is NULL. 670 - Data is NULL and *DataSize is not zero 671 @retval EFI_NOT_FOUND The configuration data specified by Selector is not found. 672 @retval EFI_UNSUPPORTED The specified DataType is not supported. 673 @retval EFI_BUFFER_TOO_SMALL The DataSize is too small for the result. DataSize has been 674 updated with the size needed to complete the request. 675 676 **/ 677 typedef 678 EFI_STATUS 679 (EFIAPI *EFI_IPSEC_CONFIG_GET_DATA)( 680 IN EFI_IPSEC_CONFIG_PROTOCOL *This, 681 IN EFI_IPSEC_CONFIG_DATA_TYPE DataType, 682 IN EFI_IPSEC_CONFIG_SELECTOR *Selector, 683 IN OUT UINTN *DataSize, 684 OUT VOID *Data 685 ); 686 687 /** 688 Enumerates the current selector for IPsec configuration data entry. 689 690 This function is called multiple times to retrieve the entry Selector in IPsec 691 configuration database. On each call to GetNextSelector(), the next entry 692 Selector are retrieved into the output interface. 693 694 If the entire IPsec configuration database has been iterated, the error 695 EFI_NOT_FOUND is returned. 696 If the Selector buffer is too small for the next Selector copy, an 697 EFI_BUFFER_TOO_SMALL error is returned, and SelectorSize is updated to reflect 698 the size of buffer needed. 699 700 On the initial call to GetNextSelector() to start the IPsec configuration database 701 search, a pointer to the buffer with all zero value is passed in Selector. Calls 702 to SetData() between calls to GetNextSelector may produce unpredictable results. 703 704 @param[in] This Pointer to the EFI_IPSEC_CONFIG_PROTOCOL instance. 705 @param[in] DataType The type of IPsec configuration data to retrieve. 706 @param[in, out] SelectorSize The size of the Selector buffer. 707 @param[in, out] Selector On input, supplies the pointer to last Selector that was 708 returned by GetNextSelector(). 709 On output, returns one copy of the current entry Selector 710 of a given DataType. 711 712 @retval EFI_SUCCESS The specified configuration data is got successfully. 713 @retval EFI_INVALID_PARAMETER One or more of the followings are TRUE: 714 - This is NULL. 715 - SelectorSize is NULL. 716 - Selector is NULL. 717 @retval EFI_NOT_FOUND The next configuration data entry was not found. 718 @retval EFI_UNSUPPORTED The specified DataType is not supported. 719 @retval EFI_BUFFER_TOO_SMALL The SelectorSize is too small for the result. This parameter 720 has been updated with the size needed to complete the search 721 request. 722 723 **/ 724 typedef 725 EFI_STATUS 726 (EFIAPI *EFI_IPSEC_CONFIG_GET_NEXT_SELECTOR)( 727 IN EFI_IPSEC_CONFIG_PROTOCOL *This, 728 IN EFI_IPSEC_CONFIG_DATA_TYPE DataType, 729 IN OUT UINTN *SelectorSize, 730 IN OUT EFI_IPSEC_CONFIG_SELECTOR *Selector 731 ); 732 733 /** 734 Register an event that is to be signaled whenever a configuration process on the 735 specified IPsec configuration information is done. 736 737 This function registers an event that is to be signaled whenever a configuration 738 process on the specified IPsec configuration data is done (e.g. IPsec security 739 policy database configuration is ready). An event can be registered for different 740 DataType simultaneously and the caller is responsible for determining which type 741 of configuration data causes the signaling of the event in such case. 742 743 @param[in] This Pointer to the EFI_IPSEC_CONFIG_PROTOCOL instance. 744 @param[in] DataType The type of data to be registered the event for. 745 @param[in] Event The event to be registered. 746 747 @retval EFI_SUCCESS The event is registered successfully. 748 @retval EFI_INVALID_PARAMETER This is NULL or Event is NULL. 749 @retval EFI_ACCESS_DENIED The Event is already registered for the DataType. 750 @retval EFI_UNSUPPORTED The notify registration unsupported or the specified 751 DataType is not supported. 752 753 **/ 754 typedef 755 EFI_STATUS 756 (EFIAPI *EFI_IPSEC_CONFIG_REGISTER_NOTIFY)( 757 IN EFI_IPSEC_CONFIG_PROTOCOL *This, 758 IN EFI_IPSEC_CONFIG_DATA_TYPE DataType, 759 IN EFI_EVENT Event 760 ); 761 762 /** 763 Remove the specified event that is previously registered on the specified IPsec 764 configuration data. 765 766 This function removes a previously registered event for the specified configuration data. 767 768 @param[in] This Pointer to the EFI_IPSEC_CONFIG_PROTOCOL instance. 769 @param[in] DataType The configuration data type to remove the registered event for. 770 @param[in] Event The event to be unregistered. 771 772 @retval EFI_SUCCESS The event is removed successfully. 773 @retval EFI_NOT_FOUND The Event specified by DataType could not be found in the 774 database. 775 @retval EFI_INVALID_PARAMETER This is NULL or Event is NULL. 776 @retval EFI_UNSUPPORTED The notify registration unsupported or the specified 777 DataType is not supported. 778 779 **/ 780 typedef 781 EFI_STATUS 782 (EFIAPI *EFI_IPSEC_CONFIG_UNREGISTER_NOTIFY)( 783 IN EFI_IPSEC_CONFIG_PROTOCOL *This, 784 IN EFI_IPSEC_CONFIG_DATA_TYPE DataType, 785 IN EFI_EVENT Event 786 ); 787 788 /// 789 /// EFI_IPSEC_CONFIG_PROTOCOL 790 /// provides the ability to set and lookup the IPsec SAD (Security Association Database), 791 /// SPD (Security Policy Database) data entry and configure the security association 792 /// management protocol such as IKEv2. This protocol is used as the central 793 /// repository of any policy-specific configuration for EFI IPsec driver. 794 /// EFI_IPSEC_CONFIG_PROTOCOL can be bound to both IPv4 and IPv6 stack. User can use this 795 /// protocol for IPsec configuration in both IPv4 and IPv6 environment. 796 /// 797 struct _EFI_IPSEC_CONFIG_PROTOCOL { 798 EFI_IPSEC_CONFIG_SET_DATA SetData; 799 EFI_IPSEC_CONFIG_GET_DATA GetData; 800 EFI_IPSEC_CONFIG_GET_NEXT_SELECTOR GetNextSelector; 801 EFI_IPSEC_CONFIG_REGISTER_NOTIFY RegisterDataNotify; 802 EFI_IPSEC_CONFIG_UNREGISTER_NOTIFY UnregisterDataNotify; 803 }; 804 805 extern EFI_GUID gEfiIpSecConfigProtocolGuid; 806 807 #endif 808