95616b8661
The "ISCSI_CHAP_AUTH_DATA.OutChallenge" field is declared as a UINT8 array with ISCSI_CHAP_AUTH_MAX_LEN (1024) elements. However, when the challenge is generated and formatted, only ISCSI_CHAP_RSP_LEN (16) octets are used in the array. Change the array size to ISCSI_CHAP_RSP_LEN, and remove the (now unused) ISCSI_CHAP_AUTH_MAX_LEN macro. Remove the "ISCSI_CHAP_AUTH_DATA.OutChallengeLength" field, which is superfluous too. Most importantly, explain in a new comment *why* tying the challenge size to the digest size (ISCSI_CHAP_RSP_LEN) has always made sense. (See also Linux kernel commit 19f5f88ed779, "scsi: target: iscsi: tie the challenge length to the hash digest size", 2019-11-06.) For sure, the motivation that the new comment now explains has always been there, and has always been the same, for IScsiDxe; it's just that now we spell it out too. No change in peer-visible behavior. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Message-Id: <20210608121259.32451-4-lersek@redhat.com>
107 lines
3.2 KiB
C
107 lines
3.2 KiB
C
/** @file
|
|
The header file of CHAP configuration.
|
|
|
|
Copyright (c) 2004 - 2018, Intel Corporation. All rights reserved.<BR>
|
|
SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
|
|
**/
|
|
|
|
#ifndef _ISCSI_CHAP_H_
|
|
#define _ISCSI_CHAP_H_
|
|
|
|
#define ISCSI_AUTH_METHOD_CHAP "CHAP"
|
|
|
|
#define ISCSI_KEY_CHAP_ALGORITHM "CHAP_A"
|
|
#define ISCSI_KEY_CHAP_IDENTIFIER "CHAP_I"
|
|
#define ISCSI_KEY_CHAP_CHALLENGE "CHAP_C"
|
|
#define ISCSI_KEY_CHAP_NAME "CHAP_N"
|
|
#define ISCSI_KEY_CHAP_RESPONSE "CHAP_R"
|
|
|
|
#define ISCSI_CHAP_ALGORITHM_MD5 5
|
|
|
|
///
|
|
/// MD5_HASHSIZE
|
|
///
|
|
#define ISCSI_CHAP_RSP_LEN 16
|
|
|
|
#define ISCSI_CHAP_STEP_ONE 1
|
|
#define ISCSI_CHAP_STEP_TWO 2
|
|
#define ISCSI_CHAP_STEP_THREE 3
|
|
#define ISCSI_CHAP_STEP_FOUR 4
|
|
|
|
|
|
#pragma pack(1)
|
|
|
|
typedef struct _ISCSI_CHAP_AUTH_CONFIG_NVDATA {
|
|
UINT8 CHAPType;
|
|
CHAR8 CHAPName[ISCSI_CHAP_NAME_STORAGE];
|
|
CHAR8 CHAPSecret[ISCSI_CHAP_SECRET_STORAGE];
|
|
CHAR8 ReverseCHAPName[ISCSI_CHAP_NAME_STORAGE];
|
|
CHAR8 ReverseCHAPSecret[ISCSI_CHAP_SECRET_STORAGE];
|
|
} ISCSI_CHAP_AUTH_CONFIG_NVDATA;
|
|
|
|
#pragma pack()
|
|
|
|
///
|
|
/// ISCSI CHAP Authentication Data
|
|
///
|
|
typedef struct _ISCSI_CHAP_AUTH_DATA {
|
|
ISCSI_CHAP_AUTH_CONFIG_NVDATA *AuthConfig;
|
|
UINT32 InIdentifier;
|
|
UINT8 InChallenge[1024];
|
|
UINT32 InChallengeLength;
|
|
//
|
|
// Calculated CHAP Response (CHAP_R) value.
|
|
//
|
|
UINT8 CHAPResponse[ISCSI_CHAP_RSP_LEN];
|
|
|
|
//
|
|
// Auth-data to be sent out for mutual authentication.
|
|
//
|
|
// While the challenge size is technically independent of the hashing
|
|
// algorithm, it is good practice to avoid hashing *fewer bytes* than the
|
|
// digest size. In other words, it's good practice to feed *at least as many
|
|
// bytes* to the hashing algorithm as the hashing algorithm will output.
|
|
//
|
|
UINT32 OutIdentifier;
|
|
UINT8 OutChallenge[ISCSI_CHAP_RSP_LEN];
|
|
} ISCSI_CHAP_AUTH_DATA;
|
|
|
|
/**
|
|
This function checks the received iSCSI Login Response during the security
|
|
negotiation stage.
|
|
|
|
@param[in] Conn The iSCSI connection.
|
|
|
|
@retval EFI_SUCCESS The Login Response passed the CHAP validation.
|
|
@retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
|
|
@retval EFI_PROTOCOL_ERROR Some kind of protocol error occurred.
|
|
@retval Others Other errors as indicated.
|
|
|
|
**/
|
|
EFI_STATUS
|
|
IScsiCHAPOnRspReceived (
|
|
IN ISCSI_CONNECTION *Conn
|
|
);
|
|
/**
|
|
This function fills the CHAP authentication information into the login PDU
|
|
during the security negotiation stage in the iSCSI connection login.
|
|
|
|
@param[in] Conn The iSCSI connection.
|
|
@param[in, out] Pdu The PDU to send out.
|
|
|
|
@retval EFI_SUCCESS All check passed and the phase-related CHAP
|
|
authentication info is filled into the iSCSI
|
|
PDU.
|
|
@retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
|
|
@retval EFI_PROTOCOL_ERROR Some kind of protocol error occurred.
|
|
|
|
**/
|
|
EFI_STATUS
|
|
IScsiCHAPToSendReq (
|
|
IN ISCSI_CONNECTION *Conn,
|
|
IN OUT NET_BUF *Pdu
|
|
);
|
|
|
|
#endif
|