IpSecConfig.h@ 62180

最後變更在這個檔案從62180是 58466,由 vboxsync 提交於 9 年前
EFI/Firmware: Merged in the svn:eol-style, svn:mime-type and trailing whitespace cleanup that was done after the initial UDK2014.SP1 import: svn merge ^{/vendor/edk2/UDK2014.SP1}/vendor/edk2/current .
屬性 svn:eol-style 設為 `native`
檔案大小: 28.1 KB

行
1	/** @file
2	EFI IPsec Configuration Protocol Definition
3	The EFI_IPSEC_CONFIG_PROTOCOL provides the mechanism to set and retrieve security and
4	policy related information for the EFI IPsec protocol driver.
5
6	Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>
7	This program and the accompanying materials
8	are licensed and made available under the terms and conditions of the BSD License
9	which accompanies this distribution. The full text of the license may be found at
10	http://opensource.org/licenses/bsd-license.php
11
12	THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
13	WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
14
15	@par Revision Reference:
16	This Protocol is introduced in UEFI Specification 2.2
17
18	**/
19
20	#ifndef __EFI_IPSE_CCONFIG_PROTOCOL_H__
21	#define __EFI_IPSE_CCONFIG_PROTOCOL_H__
22
23
24	#define EFI_IPSEC_CONFIG_PROTOCOL_GUID \
25	{ \
26	0xce5e5929, 0xc7a3, 0x4602, {0xad, 0x9e, 0xc9, 0xda, 0xf9, 0x4e, 0xbf, 0xcf } \
27	}
28
29	typedef struct _EFI_IPSEC_CONFIG_PROTOCOL EFI_IPSEC_CONFIG_PROTOCOL;
30
31	///
32	/// EFI_IPSEC_CONFIG_DATA_TYPE
33	///
34	typedef enum {
35	///
36	/// The IPsec Security Policy Database (aka SPD) setting. In IPsec,
37	/// an essential element of Security Association (SA) processing is
38	/// underlying SPD that specifies what services are to be offered to
39	/// IP datagram and in what fashion. The SPD must be consulted
40	/// during the processing of all traffic (inbound and outbound),
41	/// including traffic not protected by IPsec, that traverses the IPsec
42	/// boundary. With this DataType, SetData() function is to set
43	/// the SPD entry information, which may add one new entry, delete
44	/// one existed entry or flush the whole database according to the
45	/// parameter values. The corresponding Data is of type
46	/// EFI_IPSEC_SPD_DATA
47	///
48	IPsecConfigDataTypeSpd,
49	///
50	/// The IPsec Security Association Database (aka SAD) setting. A
51	/// SA is a simplex connection that affords security services to the
52	/// traffic carried by it. Security services are afforded to an SA by the
53	/// use of AH, or ESP, but not both. The corresponding Data is of
54	/// type EFI_IPSEC_SAD_DATA.
55	///
56	IPsecConfigDataTypeSad,
57	///
58	/// The IPsec Peer Authorization Database (aka PAD) setting, which
59	/// provides the link between the SPD and a security association
60	/// management protocol. The PAD entry specifies the
61	/// authentication protocol (e.g. IKEv1, IKEv2) method used and the
62	/// authentication data. The corresponding Data is of type
63	/// EFI_IPSEC_PAD_DATA.
64	///
65	IPsecConfigDataTypePad,
66	IPsecConfigDataTypeMaximum
67	} EFI_IPSEC_CONFIG_DATA_TYPE;
68
69	///
70	/// EFI_IP_ADDRESS_INFO
71	///
72	typedef struct _EFI_IP_ADDRESS_INFO {
73	EFI_IP_ADDRESS Address; ///< The IPv4 or IPv6 address
74	UINT8 PrefixLength; ///< The length of the prefix associated with the Address.
75	} EFI_IP_ADDRESS_INFO;
76
77
78	///
79	/// EFI_IPSEC_SPD_SELECTOR
80	///
81	typedef struct _EFI_IPSEC_SPD_SELECTOR {
82	///
83	/// Specifies the actual number of entries in LocalAddress.
84	///
85	UINT32 LocalAddressCount;
86	///
87	/// A list of ranges of IPv4 or IPv6 addresses, which refers to the
88	/// addresses being protected by IPsec policy.
89	///
90	EFI_IP_ADDRESS_INFO *LocalAddress;
91	///
92	/// Specifies the actual number of entries in RemoteAddress.
93	///
94	UINT32 RemoteAddressCount;
95	///
96	/// A list of ranges of IPv4 or IPv6 addresses, which are peer entities
97	/// to LocalAddress.
98	///
99	EFI_IP_ADDRESS_INFO *RemoteAddress;
100	///
101	/// Next layer protocol. Obtained from the IPv4 Protocol or the IPv6
102	/// Next Header fields. The next layer protocol is whatever comes
103	/// after any IP extension headers that are present. A zero value is a
104	/// wildcard that matches any value in NextLayerProtocol field.
105	///
106	UINT16 NextLayerProtocol;
107	///
108	/// Local Port if the Next Layer Protocol uses two ports (as do TCP,
109	/// UDP, and others). A zero value is a wildcard that matches any
110	/// value in LocalPort field.
111	///
112	UINT16 LocalPort;
113	///
114	/// A designed port range size. The start port is LocalPort, and
115	/// the total number of ports is described by LocalPortRange.
116	/// This field is ignored if NextLayerProtocol does not use
117	/// ports.
118	///
119	UINT16 LocalPortRange;
120	///
121	/// Remote Port if the Next Layer Protocol uses two ports. A zero
122	/// value is a wildcard that matches any value in RemotePort field.
123	///
124	UINT16 RemotePort;
125	///
126	/// A designed port range size. The start port is RemotePort, and
127	/// the total number of ports is described by RemotePortRange.
128	/// This field is ignored if NextLayerProtocol does not use ports.
129	///
130	UINT16 RemotePortRange;
131	} EFI_IPSEC_SPD_SELECTOR;
132
133	///
134	/// EFI_IPSEC_TRAFFIC_DIR
135	/// represents the directionality in an SPD entry.
136	///
137	typedef enum {
138	///
139	/// The EfiIPsecInBound refers to traffic entering an IPsec implementation via
140	/// the unprotected interface or emitted by the implementation on the unprotected
141	/// side of the boundary and directed towards the protected interface.
142	///
143	EfiIPsecInBound,
144	///
145	/// The EfiIPsecOutBound refers to traffic entering the implementation via
146	/// the protected interface, or emitted by the implementation on the protected side
147	/// of the boundary and directed toward the unprotected interface.
148	///
149	EfiIPsecOutBound
150	} EFI_IPSEC_TRAFFIC_DIR;
151
152	///
153	/// EFI_IPSEC_ACTION
154	/// represents three possible processing choices.
155	///
156	typedef enum {
157	///
158	/// Refers to traffic that is not allowed to traverse the IPsec boundary.
159	///
160	EfiIPsecActionDiscard,
161	///
162	/// Refers to traffic that is allowed to cross the IPsec boundary
163	/// without protection.
164	///
165	EfiIPsecActionBypass,
166	///
167	/// Refers to traffic that is afforded IPsec protection, and for such
168	/// traffic the SPD must specify the security protocols to be
169	/// employed, their mode, security service options, and the
170	/// cryptographic algorithms to be used.
171	///
172	EfiIPsecActionProtect
173	} EFI_IPSEC_ACTION;
174
175	///
176	/// EFI_IPSEC_SA_LIFETIME
177	/// defines the lifetime of an SA, which represents when a SA must be
178	/// replaced or terminated. A value of all 0 for each field removes
179	/// the limitation of a SA lifetime.
180	///
181	typedef struct _EFI_IPSEC_SA_LIFETIME {
182	///
183	/// The number of bytes to which the IPsec cryptographic algorithm
184	/// can be applied. For ESP, this is the encryption algorithm and for
185	/// AH, this is the authentication algorithm. The ByteCount
186	/// includes pad bytes for cryptographic operations.
187	///
188	UINT64 ByteCount;
189	///
190	/// A time interval in second that warns the implementation to
191	/// initiate action such as setting up a replacement SA.
192	///
193	UINT64 SoftLifetime;
194	///
195	/// A time interval in second when the current SA ends and is
196	/// destroyed.
197	///
198	UINT64 HardLifetime;
199	} EFI_IPSEC_SA_LIFETIME;
200
201	///
202	/// EFI_IPSEC_MODE
203	/// There are two modes of IPsec operation: transport mode and tunnel mode. In
204	/// EfiIPsecTransport mode, AH and ESP provide protection primarily for next layer protocols;
205	/// In EfiIPsecTunnel mode, AH and ESP are applied to tunneled IP packets.
206	///
207	typedef enum {
208	EfiIPsecTransport,
209	EfiIPsecTunnel
210	} EFI_IPSEC_MODE;
211
212	///
213	/// EFI_IPSEC_TUNNEL_DF_OPTION
214	/// The option of copying the DF bit from an outbound package to
215	/// the tunnel mode header that it emits, when traffic is carried
216	/// via a tunnel mode SA. This applies to SAs where both inner and
217	/// outer headers are IPv4.
218	///
219	typedef enum {
220	EfiIPsecTunnelClearDf, ///< Clear DF bit from inner header.
221	EfiIPsecTunnelSetDf, ///< Set DF bit from inner header.
222	EfiIPsecTunnelCopyDf ///< Copy DF bit from inner header.
223	} EFI_IPSEC_TUNNEL_DF_OPTION;
224
225	///
226	/// EFI_IPSEC_TUNNEL_OPTION
227	///
228	typedef struct _EFI_IPSEC_TUNNEL_OPTION {
229	///
230	/// Local tunnel address when IPsec mode is EfiIPsecTunnel.
231	///
232	EFI_IP_ADDRESS LocalTunnelAddress;
233	///
234	/// Remote tunnel address when IPsec mode is EfiIPsecTunnel.
235	///
236	EFI_IP_ADDRESS RemoteTunnelAddress;
237	///
238	/// The option of copying the DF bit from an outbound package
239	/// to the tunnel mode header that it emits, when traffic is
240	/// carried via a tunnel mode SA.
241	///
242	EFI_IPSEC_TUNNEL_DF_OPTION DF;
243	} EFI_IPSEC_TUNNEL_OPTION;
244
245	///
246	/// EFI_IPSEC_PROTOCOL_TYPE
247	///
248	typedef enum {
249	EfiIPsecAH, ///< IP Authentication Header protocol which is specified in RFC 4302.
250	EfiIPsecESP ///< IP Encapsulating Security Payload which is specified in RFC 4303.
251	} EFI_IPSEC_PROTOCOL_TYPE;
252
253	///
254	/// EFI_IPSEC_PROCESS_POLICY
255	/// describes a policy list for traffic processing.
256	///
257	typedef struct _EFI_IPSEC_PROCESS_POLICY {
258	///
259	/// Extended Sequence Number. Is this SA using extended sequence
260	/// numbers. 64 bit counter is used if TRUE.
261	///
262	BOOLEAN ExtSeqNum;
263	///
264	/// A flag indicating whether overflow of the sequence number
265	/// counter should generate an auditable event and prevent
266	/// transmission of additional packets on the SA, or whether rollover
267	/// is permitted.
268	///
269	BOOLEAN SeqOverflow;
270	///
271	/// Is this SA using stateful fragment checking. TRUE represents
272	/// stateful fragment checking.
273	///
274	BOOLEAN FragCheck;
275	///
276	/// A time interval after which a SA must be replaced with a new SA
277	/// (and new SPI) or terminated.
278	///
279	EFI_IPSEC_SA_LIFETIME SaLifetime;
280	///
281	/// IPsec mode: tunnel or transport.
282	///
283	EFI_IPSEC_MODE Mode;
284	///
285	/// Tunnel Option. TunnelOption is ignored if Mode is EfiIPsecTransport.
286	///
287	EFI_IPSEC_TUNNEL_OPTION *TunnelOption;
288	///
289	/// IPsec protocol: AH or ESP
290	///
291	EFI_IPSEC_PROTOCOL_TYPE Proto;
292	///
293	/// Cryptographic algorithm type used for authentication.
294	///
295	UINT8 AuthAlgoId;
296	///
297	/// Cryptographic algorithm type used for encryption. EncAlgo is
298	/// NULL when IPsec protocol is AH. For ESP protocol, EncAlgo
299	/// can also be used to describe the algorithm if a combined mode
300	/// algorithm is used.
301	///
302	UINT8 EncAlgoId;
303	} EFI_IPSEC_PROCESS_POLICY;
304
305	///
306	/// EFI_IPSEC_SA_ID
307	/// A triplet to identify an SA, consisting of the following members.
308	///
309	typedef struct _EFI_IPSEC_SA_ID {
310	///
311	/// Security Parameter Index (aka SPI). An arbitrary 32-bit value
312	/// that is used by a receiver to identity the SA to which an incoming
313	/// package should be bound.
314	///
315	UINT32 Spi;
316	///
317	/// IPsec protocol: AH or ESP
318	///
319	EFI_IPSEC_PROTOCOL_TYPE Proto;
320	///
321	/// Destination IP address.
322	///
323	EFI_IP_ADDRESS DestAddress;
324	} EFI_IPSEC_SA_ID;
325
326
327	#define MAX_PEERID_LEN 128
328
329	///
330	/// EFI_IPSEC_SPD_DATA
331	///
332	typedef struct _EFI_IPSEC_SPD_DATA {
333	///
334	/// A null-terminated ASCII name string which is used as a symbolic
335	/// identifier for an IPsec Local or Remote address.
336	///
337	UINT8 Name[MAX_PEERID_LEN];
338	///
339	/// Bit-mapped list describing Populate from Packet flags. When
340	/// creating a SA, if PackageFlag bit is set to TRUE, instantiate
341	/// the selector from the corresponding field in the package that
342	/// triggered the creation of the SA, else from the value(s) in the
343	/// corresponding SPD entry. The PackageFlag bit setting for
344	/// corresponding selector field of EFI_IPSEC_SPD_SELECTOR:
345	/// Bit 0: EFI_IPSEC_SPD_SELECTOR.LocalAddress
346	/// Bit 1: EFI_IPSEC_SPD_SELECTOR.RemoteAddress
347	/// Bit 2:
348	/// EFI_IPSEC_SPD_SELECTOR.NextLayerProtocol
349	/// Bit 3: EFI_IPSEC_SPD_SELECTOR.LocalPort
350	/// Bit 4: EFI_IPSEC_SPD_SELECTOR.RemotePort
351	/// Others: Reserved.
352	///
353	UINT32 PackageFlag;
354	///
355	/// The traffic direction of data gram.
356	///
357	EFI_IPSEC_TRAFFIC_DIR TrafficDirection;
358	///
359	/// Processing choices to indicate which action is required by this
360	/// policy.
361	///
362	EFI_IPSEC_ACTION Action;
363	///
364	/// The policy and rule information for a SPD entry.
365	///
366	EFI_IPSEC_PROCESS_POLICY *ProcessingPolicy;
367	///
368	/// Specifies the actual number of entries in SaId list.
369	///
370	UINTN SaIdCount;
371	///
372	/// The SAD entry used for the traffic processing. The
373	/// existed SAD entry links indicate this is the manual key case.
374	///
375	EFI_IPSEC_SA_ID SaId[1];
376	} EFI_IPSEC_SPD_DATA;
377
378	///
379	/// EFI_IPSEC_AH_ALGO_INFO
380	/// The security algorithm selection for IPsec AH authentication.
381	/// The required authentication algorithm is specified in RFC 4305.
382	///
383	typedef struct _EFI_IPSEC_AH_ALGO_INFO {
384	UINT8 AuthAlgoId;
385	UINTN AuthKeyLength;
386	VOID *AuthKey;
387	} EFI_IPSEC_AH_ALGO_INFO;
388
389	///
390	/// EFI_IPSEC_ESP_ALGO_INFO
391	/// The security algorithm selection for IPsec ESP encryption and authentication.
392	/// The required authentication algorithm is specified in RFC 4305.
393	/// EncAlgoId fields can also specify an ESP combined mode algorithm
394	/// (e.g. AES with CCM mode, specified in RFC 4309), which provides both
395	/// confidentiality and authentication services.
396	///
397	typedef struct _EFI_IPSEC_ESP_ALGO_INFO {
398	UINT8 EncAlgoId;
399	UINTN EncKeyLength;
400	VOID *EncKey;
401	UINT8 AuthAlgoId;
402	UINTN AuthKeyLength;
403	VOID *AuthKey;
404	} EFI_IPSEC_ESP_ALGO_INFO;
405
406	///
407	/// EFI_IPSEC_ALGO_INFO
408	///
409	typedef union {
410	EFI_IPSEC_AH_ALGO_INFO AhAlgoInfo;
411	EFI_IPSEC_ESP_ALGO_INFO EspAlgoInfo;
412	} EFI_IPSEC_ALGO_INFO;
413
414	///
415	/// EFI_IPSEC_SA_DATA
416	///
417	typedef struct _EFI_IPSEC_SA_DATA {
418	///
419	/// IPsec mode: tunnel or transport.
420	///
421	EFI_IPSEC_MODE Mode;
422	///
423	/// Sequence Number Counter. A 64-bit counter used to generate the
424	/// sequence number field in AH or ESP headers.
425	///
426	UINT64 SNCount;
427	///
428	/// Anti-Replay Window. A 64-bit counter and a bit-map used to
429	/// determine whether an inbound AH or ESP packet is a replay.
430	///
431	UINT8 AntiReplayWindows;
432	///
433	/// AH/ESP cryptographic algorithm, key and parameters.
434	///
435	EFI_IPSEC_ALGO_INFO AlgoInfo;
436	///
437	/// Lifetime of this SA.
438	///
439	EFI_IPSEC_SA_LIFETIME SaLifetime;
440	///
441	/// Any observed path MTU and aging variables. The Path MTU
442	/// processing is defined in section 8 of RFC 4301.
443	///
444	UINT32 PathMTU;
445	///
446	/// Link to one SPD entry.
447	///
448	EFI_IPSEC_SPD_SELECTOR *SpdSelector;
449	///
450	/// Indication of whether it's manually set or negotiated automatically.
451	/// If ManualSet is FALSE, the corresponding SA entry is inserted through
452	/// IKE protocol negotiation.
453	///
454	BOOLEAN ManualSet;
455	} EFI_IPSEC_SA_DATA;
456
457	///
458	/// EFI_IPSEC_SA_DATA2
459	///
460	typedef struct _EFI_IPSEC_SA_DATA2 {
461	///
462	/// IPsec mode: tunnel or transport
463	///
464	EFI_IPSEC_MODE Mode;
465	///
466	/// Sequence Number Counter. A 64-bit counter used to generate the sequence
467	/// number field in AH or ESP headers.
468	///
469	UINT64 SNCount;
470	///
471	/// Anti-Replay Window. A 64-bit counter and a bit-map used to determine
472	/// whether an inbound AH or ESP packet is a replay.
473	///
474	UINT8 AntiReplayWindows;
475	///
476	/// AH/ESP cryptographic algorithm, key and parameters.
477	///
478	EFI_IPSEC_ALGO_INFO AlgoInfo;
479	///
480	/// Lifetime of this SA.
481	///
482	EFI_IPSEC_SA_LIFETIME SaLifetime;
483	///
484	/// Any observed path MTU and aging variables. The Path MTU processing is
485	/// defined in section 8 of RFC 4301.
486	///
487	UINT32 PathMTU;
488	///
489	/// Link to one SPD entry
490	///
491	EFI_IPSEC_SPD_SELECTOR *SpdSelector;
492	///
493	/// Indication of whether it's manually set or negotiated automatically.
494	/// If ManualSet is FALSE, the corresponding SA entry is inserted through IKE
495	/// protocol negotiation
496	///
497	BOOLEAN ManualSet;
498	///
499	/// The tunnel header IP source address.
500	///
501	EFI_IP_ADDRESS TunnelSourceAddress;
502	///
503	/// The tunnel header IP destination address.
504	///
505	EFI_IP_ADDRESS TunnelDestinationAddress;
506	} EFI_IPSEC_SA_DATA2;
507
508
509	///
510	/// EFI_IPSEC_PAD_ID
511	/// specifies the identifier for PAD entry, which is also used for SPD lookup.
512	/// IpAddress Pointer to the IPv4 or IPv6 address range.
513	///
514	typedef struct _EFI_IPSEC_PAD_ID {
515	///
516	/// Flag to identify which type of PAD Id is used.
517	///
518	BOOLEAN PeerIdValid;
519	union {
520	///
521	/// Pointer to the IPv4 or IPv6 address range.
522	///
523	EFI_IP_ADDRESS_INFO IpAddress;
524	///
525	/// Pointer to a null terminated ASCII string
526	/// representing the symbolic names. A PeerId can be a DNS
527	/// name, Distinguished Name, RFC 822 email address or Key ID
528	/// (specified in section 4.4.3.1 of RFC 4301)
529	///
530	UINT8 PeerId[MAX_PEERID_LEN];
531	} Id;
532	} EFI_IPSEC_PAD_ID;
533
534	///
535	/// EFI_IPSEC_CONFIG_SELECTOR
536	/// describes the expected IPsec configuration data selector
537	/// of type EFI_IPSEC_CONFIG_DATA_TYPE.
538	///
539	typedef union {
540	EFI_IPSEC_SPD_SELECTOR SpdSelector;
541	EFI_IPSEC_SA_ID SaId;
542	EFI_IPSEC_PAD_ID PadId;
543	} EFI_IPSEC_CONFIG_SELECTOR;
544
545	///
546	/// EFI_IPSEC_AUTH_PROTOCOL_TYPE
547	/// defines the possible authentication protocol for IPsec
548	/// security association management.
549	///
550	typedef enum {
551	EfiIPsecAuthProtocolIKEv1,
552	EfiIPsecAuthProtocolIKEv2,
553	EfiIPsecAuthProtocolMaximum
554	} EFI_IPSEC_AUTH_PROTOCOL_TYPE;
555
556	///
557	/// EFI_IPSEC_AUTH_METHOD
558	///
559	typedef enum {
560	///
561	/// Using Pre-shared Keys for manual security associations.
562	///
563	EfiIPsecAuthMethodPreSharedSecret,
564	///
565	/// IKE employs X.509 certificates for SA establishment.
566	///
567	EfiIPsecAuthMethodCertificates,
568	EfiIPsecAuthMethodMaximum
569	} EFI_IPSEC_AUTH_METHOD;
570
571	///
572	/// EFI_IPSEC_PAD_DATA
573	///
574	typedef struct _EFI_IPSEC_PAD_DATA {
575	///
576	/// Authentication Protocol for IPsec security association management.
577	///
578	EFI_IPSEC_AUTH_PROTOCOL_TYPE AuthProtocol;
579	///
580	/// Authentication method used.
581	///
582	EFI_IPSEC_AUTH_METHOD AuthMethod;
583	///
584	/// The IKE ID payload will be used as a symbolic name for SPD
585	/// lookup if IkeIdFlag is TRUE. Otherwise, the remote IP
586	/// address provided in traffic selector playloads will be used.
587	///
588	BOOLEAN IkeIdFlag;
589	///
590	/// The size of Authentication data buffer, in bytes.
591	///
592	UINTN AuthDataSize;
593	///
594	/// Buffer for Authentication data, (e.g., the pre-shared secret or the
595	/// trust anchor relative to which the peer's certificate will be
596	/// validated).
597	///
598	VOID *AuthData;
599	///
600	/// The size of RevocationData, in bytes
601	///
602	UINTN RevocationDataSize;
603	///
604	/// Pointer to CRL or OCSP data, if certificates are used for
605	/// authentication method.
606	///
607	VOID *RevocationData;
608	} EFI_IPSEC_PAD_DATA;
609
610
611	/**
612	Set the security association, security policy and peer authorization configuration
613	information for the EFI IPsec driver.
614
615	This function is used to set the IPsec configuration information of type DataType for
616	the EFI IPsec driver.
617	The IPsec configuration data has a unique selector/identifier separately to identify
618	a data entry. The selector structure depends on DataType's definition.
619	Using SetData() with a Data of NULL causes the IPsec configuration data entry identified
620	by DataType and Selector to be deleted.
621
622	@param[in] This Pointer to the EFI_IPSEC_CONFIG_PROTOCOL instance.
623	@param[in] DataType The type of data to be set.
624	@param[in] Selector Pointer to an entry selector on operated configuration data
625	specified by DataType. A NULL Selector causes the entire
626	specified-type configuration information to be flushed.
627	@param[in] Data The data buffer to be set. The structure of the data buffer is
628	associated with the DataType.
629	@param[in] InsertBefore Pointer to one entry selector which describes the expected
630	position the new data entry will be added. If InsertBefore is NULL,
631	the new entry will be appended the end of database.
632
633	@retval EFI_SUCCESS The specified configuration entry data is set successfully.
634	@retval EFI_INVALID_PARAMETER One or more of the following are TRUE:
635	- This is NULL.
636	@retval EFI_UNSUPPORTED The specified DataType is not supported.
637	@retval EFI_OUT_OF_RESOURCED The required system resource could not be allocated.
638
639	**/
640	typedef
641	EFI_STATUS
642	(EFIAPI *EFI_IPSEC_CONFIG_SET_DATA)(
643	IN EFI_IPSEC_CONFIG_PROTOCOL *This,
644	IN EFI_IPSEC_CONFIG_DATA_TYPE DataType,
645	IN EFI_IPSEC_CONFIG_SELECTOR *Selector,
646	IN VOID *Data,
647	IN EFI_IPSEC_CONFIG_SELECTOR *InsertBefore OPTIONAL
648	);
649
650	/**
651	Return the configuration value for the EFI IPsec driver.
652
653	This function lookup the data entry from IPsec database or IKEv2 configuration
654	information. The expected data type and unique identification are described in
655	DataType and Selector parameters.
656
657	@param[in] This Pointer to the EFI_IPSEC_CONFIG_PROTOCOL instance.
658	@param[in] DataType The type of data to retrieve.
659	@param[in] Selector Pointer to an entry selector which is an identifier of the IPsec
660	configuration data entry.
661	@param[in, out] DataSize On output the size of data returned in Data.
662	@param[out] Data The buffer to return the contents of the IPsec configuration data.
663	The type of the data buffer is associated with the DataType.
664
665	@retval EFI_SUCCESS The specified configuration data is got successfully.
666	@retval EFI_INVALID_PARAMETER One or more of the followings are TRUE:
667	- This is NULL.
668	- Selector is NULL.
669	- DataSize is NULL.
670	- Data is NULL and *DataSize is not zero
671	@retval EFI_NOT_FOUND The configuration data specified by Selector is not found.
672	@retval EFI_UNSUPPORTED The specified DataType is not supported.
673	@retval EFI_BUFFER_TOO_SMALL The DataSize is too small for the result. DataSize has been
674	updated with the size needed to complete the request.
675
676	**/
677	typedef
678	EFI_STATUS
679	(EFIAPI *EFI_IPSEC_CONFIG_GET_DATA)(
680	IN EFI_IPSEC_CONFIG_PROTOCOL *This,
681	IN EFI_IPSEC_CONFIG_DATA_TYPE DataType,
682	IN EFI_IPSEC_CONFIG_SELECTOR *Selector,
683	IN OUT UINTN *DataSize,
684	OUT VOID *Data
685	);
686
687	/**
688	Enumerates the current selector for IPsec configuration data entry.
689
690	This function is called multiple times to retrieve the entry Selector in IPsec
691	configuration database. On each call to GetNextSelector(), the next entry
692	Selector are retrieved into the output interface.
693
694	If the entire IPsec configuration database has been iterated, the error
695	EFI_NOT_FOUND is returned.
696	If the Selector buffer is too small for the next Selector copy, an
697	EFI_BUFFER_TOO_SMALL error is returned, and SelectorSize is updated to reflect
698	the size of buffer needed.
699
700	On the initial call to GetNextSelector() to start the IPsec configuration database
701	search, a pointer to the buffer with all zero value is passed in Selector. Calls
702	to SetData() between calls to GetNextSelector may produce unpredictable results.
703
704	@param[in] This Pointer to the EFI_IPSEC_CONFIG_PROTOCOL instance.
705	@param[in] DataType The type of IPsec configuration data to retrieve.
706	@param[in, out] SelectorSize The size of the Selector buffer.
707	@param[in, out] Selector On input, supplies the pointer to last Selector that was
708	returned by GetNextSelector().
709	On output, returns one copy of the current entry Selector
710	of a given DataType.
711
712	@retval EFI_SUCCESS The specified configuration data is got successfully.
713	@retval EFI_INVALID_PARAMETER One or more of the followings are TRUE:
714	- This is NULL.
715	- SelectorSize is NULL.
716	- Selector is NULL.
717	@retval EFI_NOT_FOUND The next configuration data entry was not found.
718	@retval EFI_UNSUPPORTED The specified DataType is not supported.
719	@retval EFI_BUFFER_TOO_SMALL The SelectorSize is too small for the result. This parameter
720	has been updated with the size needed to complete the search
721	request.
722
723	**/
724	typedef
725	EFI_STATUS
726	(EFIAPI *EFI_IPSEC_CONFIG_GET_NEXT_SELECTOR)(
727	IN EFI_IPSEC_CONFIG_PROTOCOL *This,
728	IN EFI_IPSEC_CONFIG_DATA_TYPE DataType,
729	IN OUT UINTN *SelectorSize,
730	IN OUT EFI_IPSEC_CONFIG_SELECTOR *Selector
731	);
732
733	/**
734	Register an event that is to be signaled whenever a configuration process on the
735	specified IPsec configuration information is done.
736
737	This function registers an event that is to be signaled whenever a configuration
738	process on the specified IPsec configuration data is done (e.g. IPsec security
739	policy database configuration is ready). An event can be registered for different
740	DataType simultaneously and the caller is responsible for determining which type
741	of configuration data causes the signaling of the event in such case.
742
743	@param[in] This Pointer to the EFI_IPSEC_CONFIG_PROTOCOL instance.
744	@param[in] DataType The type of data to be registered the event for.
745	@param[in] Event The event to be registered.
746
747	@retval EFI_SUCCESS The event is registered successfully.
748	@retval EFI_INVALID_PARAMETER This is NULL or Event is NULL.
749	@retval EFI_ACCESS_DENIED The Event is already registered for the DataType.
750	@retval EFI_UNSUPPORTED The notify registration unsupported or the specified
751	DataType is not supported.
752
753	**/
754	typedef
755	EFI_STATUS
756	(EFIAPI *EFI_IPSEC_CONFIG_REGISTER_NOTIFY)(
757	IN EFI_IPSEC_CONFIG_PROTOCOL *This,
758	IN EFI_IPSEC_CONFIG_DATA_TYPE DataType,
759	IN EFI_EVENT Event
760	);
761
762	/**
763	Remove the specified event that is previously registered on the specified IPsec
764	configuration data.
765
766	This function removes a previously registered event for the specified configuration data.
767
768	@param[in] This Pointer to the EFI_IPSEC_CONFIG_PROTOCOL instance.
769	@param[in] DataType The configuration data type to remove the registered event for.
770	@param[in] Event The event to be unregistered.
771
772	@retval EFI_SUCCESS The event is removed successfully.
773	@retval EFI_NOT_FOUND The Event specified by DataType could not be found in the
774	database.
775	@retval EFI_INVALID_PARAMETER This is NULL or Event is NULL.
776	@retval EFI_UNSUPPORTED The notify registration unsupported or the specified
777	DataType is not supported.
778
779	**/
780	typedef
781	EFI_STATUS
782	(EFIAPI *EFI_IPSEC_CONFIG_UNREGISTER_NOTIFY)(
783	IN EFI_IPSEC_CONFIG_PROTOCOL *This,
784	IN EFI_IPSEC_CONFIG_DATA_TYPE DataType,
785	IN EFI_EVENT Event
786	);
787
788	///
789	/// EFI_IPSEC_CONFIG_PROTOCOL
790	/// provides the ability to set and lookup the IPsec SAD (Security Association Database),
791	/// SPD (Security Policy Database) data entry and configure the security association
792	/// management protocol such as IKEv2. This protocol is used as the central
793	/// repository of any policy-specific configuration for EFI IPsec driver.
794	/// EFI_IPSEC_CONFIG_PROTOCOL can be bound to both IPv4 and IPv6 stack. User can use this
795	/// protocol for IPsec configuration in both IPv4 and IPv6 environment.
796	///
797	struct _EFI_IPSEC_CONFIG_PROTOCOL {
798	EFI_IPSEC_CONFIG_SET_DATA SetData;
799	EFI_IPSEC_CONFIG_GET_DATA GetData;
800	EFI_IPSEC_CONFIG_GET_NEXT_SELECTOR GetNextSelector;
801	EFI_IPSEC_CONFIG_REGISTER_NOTIFY RegisterDataNotify;
802	EFI_IPSEC_CONFIG_UNREGISTER_NOTIFY UnregisterDataNotify;
803	};
804
805	extern EFI_GUID gEfiIpSecConfigProtocolGuid;
806
807	#endif

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/VBox/Devices/EFI/Firmware/MdePkg/Include/Protocol/IpSecConfig.h@ 62180

以其他格式下載: