MdeModulePkg/Universal/Network/IScsiDxe/IScsiCHAP.c

   1 /** @file
   2   This file is for Challenge-Handshake Authentication Protocol (CHAP) Configuration.
   3
   4 Copyright (c) 2004 - 2008, Intel Corporation.<BR>
   5 All rights reserved. This program and the accompanying materials
   6 are licensed and made available under the terms and conditions of the BSD License
   7 which accompanies this distribution.  The full text of the license may be found at
   8 http://opensource.org/licenses/bsd-license.php
   9
  10 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  11 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  12
  13 **/
  14
  15 #include "IScsiImpl.h"
  16 #include "Md5.h"
  17
  18 EFI_GUID  mIScsiCHAPAuthInfoGuid = ISCSI_CHAP_AUTH_INFO_GUID;
  19
  20 /**
  21   Initator caculates its own expected hash value.
  22
  23   @param[in]   ChapIdentifier     iSCSI CHAP identifier sent by authenticator.
  24   @param[in]   ChapSecret         iSCSI CHAP secret of the authenticator.
  25   @param[in]   SecretLength       The length of iSCSI CHAP secret.
  26   @param[in]   ChapChallenge      The challenge message sent by authenticator.
  27   @param[in]   ChallengeLength    The length of iSCSI CHAP challenge message.
  28   @param[out]  ChapResponse       The calculation of the expected hash value.
  29
  30   @retval EFI_SUCCESS             The expected hash value was caculatedly successfully.
  31   @retval EFI_PROTOCOL_ERROR      The length of the secret should be at least the
  32                                   length of the hash value for the hashing algorithm chosen.
  33   @retval Others                  Other errors as indicated.
  34 **/
  35 EFI_STATUS
  36 IScsiCHAPCalculateResponse (
  37   IN  UINT32  ChapIdentifier,
  38   IN  CHAR8   *ChapSecret,
  39   IN  UINT32  SecretLength,
  40   IN  UINT8   *ChapChallenge,
  41   IN  UINT32  ChallengeLength,
  42   OUT UINT8   *ChapResponse
  43   )
  44 {
  45   MD5_CTX     Md5Ctx;
  46   CHAR8       IdByte[1];
  47   EFI_STATUS  Status;
  48
  49   Status = MD5Init (&Md5Ctx);
  50
  51   //
  52   // Hash Identifier - Only calculate 1 byte data (RFC1994)
  53   //
  54   IdByte[0] = (CHAR8) ChapIdentifier;
  55   MD5Update (&Md5Ctx, IdByte, 1);
  56
  57   //
  58   // Hash Secret
  59   //
  60   if (SecretLength < ISCSI_CHAP_SECRET_MIN_LEN - 1) {
  61     return EFI_PROTOCOL_ERROR;
  62   }
  63
  64   MD5Update (&Md5Ctx, ChapSecret, SecretLength);
  65
  66   //
  67   // Hash Challenge received from Target
  68   //
  69   MD5Update (&Md5Ctx, ChapChallenge, ChallengeLength);
  70
  71   Status = MD5Final (&Md5Ctx, ChapResponse);
  72
  73   return Status;
  74 }
  75
  76 /**
  77   The initator checks the CHAP response replied by target against its own
  78   calculation of the expected hash value.
  79
  80   @param[in]   AuthData             iSCSI CHAP authentication data.
  81   @param[in]   TargetResponse       The response from target.
  82
  83   @retval EFI_SUCCESS               The response from target passed authentication.
  84   @retval EFI_SECURITY_VIOLATION    The response from target was not expected value.
  85   @retval Others                    Other errors as indicated.
  86 **/
  87 EFI_STATUS
  88 IScsiCHAPAuthTarget (
  89   IN  ISCSI_CHAP_AUTH_DATA  *AuthData,
  90   IN  UINT8                 *TargetResponse
  91   )
  92 {
  93   EFI_STATUS  Status;
  94   UINT32      SecretSize;
  95   UINT8       VerifyRsp[ISCSI_CHAP_RSP_LEN];
  96
  97   Status      = EFI_SUCCESS;
  98
  99   SecretSize  = (UINT32) AsciiStrLen (AuthData->AuthConfig.ReverseCHAPSecret);
 100   Status = IScsiCHAPCalculateResponse (
 101             AuthData->OutIdentifier,
 102             AuthData->AuthConfig.ReverseCHAPSecret,
 103             SecretSize,
 104             AuthData->OutChallenge,
 105             AuthData->OutChallengeLength,
 106             VerifyRsp
 107             );
 108
 109   if (CompareMem (VerifyRsp, TargetResponse, ISCSI_CHAP_RSP_LEN)) {
 110     Status = EFI_SECURITY_VIOLATION;
 111   }
 112
 113   return Status;
 114 }
 115
 116 /**
 117   This function checks the received iSCSI Login Response during the security
 118   negotiation stage.
 119
 120   @param[in] Conn             The iSCSI connection.
 121
 122   @retval EFI_SUCCESS          The Login Response passed the CHAP validation.
 123   @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
 124   @retval EFI_PROTOCOL_ERROR   Some kind of protocol error happend.
 125   @retval Others               Other errors as indicated.
 126 **/
 127 EFI_STATUS
 128 IScsiCHAPOnRspReceived (
 129   IN ISCSI_CONNECTION  *Conn
 130   )
 131 {
 132   EFI_STATUS                Status;
 133   ISCSI_SESSION             *Session;
 134   ISCSI_CHAP_AUTH_DATA      *AuthData;
 135   CHAR8                     *Value;
 136   UINT8                     *Data;
 137   UINT32                    Len;
 138   LIST_ENTRY                *KeyValueList;
 139   UINTN                     Algorithm;
 140   CHAR8                     *Identifier;
 141   CHAR8                     *Challenge;
 142   CHAR8                     *Name;
 143   CHAR8                     *Response;
 144   UINT8                     TargetRsp[ISCSI_CHAP_RSP_LEN];
 145   UINT32                    RspLen;
 146
 147   ASSERT (Conn->CurrentStage == ISCSI_SECURITY_NEGOTIATION);
 148   ASSERT (Conn->RspQue.BufNum != 0);
 149
 150   Session     = Conn->Session;
 151   AuthData    = &Session->AuthData;
 152
 153   Len         = Conn->RspQue.BufSize;
 154   Data        = AllocatePool (Len);
 155   if (Data == NULL) {
 156     return EFI_OUT_OF_RESOURCES;
 157   }
 158   //
 159   // Copy the data in case the data spans over multiple PDUs.
 160   //
 161   NetbufQueCopy (&Conn->RspQue, 0, Len, Data);
 162
 163   //
 164   // Build the key-value list from the data segment of the Login Response.
 165   //
 166   KeyValueList = IScsiBuildKeyValueList ((CHAR8 *) Data, Len);
 167   if (KeyValueList == NULL) {
 168     Status = EFI_OUT_OF_RESOURCES;
 169     goto ON_EXIT;
 170   }
 171
 172   Status = EFI_PROTOCOL_ERROR;
 173
 174   switch (Conn->CHAPStep) {
 175   case ISCSI_CHAP_INITIAL:
 176     //
 177     // The first Login Response.
 178     //
 179     Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_TARGET_PORTAL_GROUP_TAG);
 180     if (Value == NULL) {
 181       goto ON_EXIT;
 182     }
 183
 184     Session->TargetPortalGroupTag = (UINT16) AsciiStrDecimalToUintn (Value);
 185
 186     Value                         = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_AUTH_METHOD);
 187     if (Value == NULL) {
 188       goto ON_EXIT;
 189     }
 190     //
 191     // Initiator mandates CHAP authentication but target replies without "CHAP" or
 192     // initiator suggets "None" but target replies with some kind of auth method.
 193     //
 194     if (AsciiStrCmp (Value, ISCSI_AUTH_METHOD_CHAP) == 0) {
 195       if (AuthData->AuthConfig.CHAPType == ISCSI_CHAP_NONE) {
 196         goto ON_EXIT;
 197       }
 198     } else {
 199       if (AuthData->AuthConfig.CHAPType != ISCSI_CHAP_NONE) {
 200         goto ON_EXIT;
 201       }
 202     }
 203     //
 204     // Transit to CHAP step one.
 205     //
 206     Conn->CHAPStep  = ISCSI_CHAP_STEP_ONE;
 207     Status          = EFI_SUCCESS;
 208     break;
 209
 210   case ISCSI_CHAP_STEP_TWO:
 211     //
 212     // The Target replies with CHAP_A=<A> CHAP_I=<I> CHAP_C=<C>
 213     //
 214     Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_ALGORITHM);
 215     if (Value == NULL) {
 216       goto ON_EXIT;
 217     }
 218
 219     Algorithm = AsciiStrDecimalToUintn (Value);
 220     if (Algorithm != ISCSI_CHAP_ALGORITHM_MD5) {
 221       //
 222       // Unsupported algorithm is chosen by target.
 223       //
 224       goto ON_EXIT;
 225     }
 226
 227     Identifier = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_IDENTIFIER);
 228     if (Identifier == NULL) {
 229       goto ON_EXIT;
 230     }
 231
 232     Challenge = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_CHALLENGE);
 233     if (Challenge == NULL) {
 234       goto ON_EXIT;
 235     }
 236     //
 237     // Process the CHAP identifier and CHAP Challenge from Target
 238     // Calculate Response value
 239     //
 240     AuthData->InIdentifier      = (UINT32) AsciiStrDecimalToUintn (Identifier);
 241     AuthData->InChallengeLength = ISCSI_CHAP_AUTH_MAX_LEN;
 242     IScsiHexToBin ((UINT8 *) AuthData->InChallenge, &AuthData->InChallengeLength, Challenge);
 243     Status = IScsiCHAPCalculateResponse (
 244               AuthData->InIdentifier,
 245               AuthData->AuthConfig.CHAPSecret,
 246               (UINT32) AsciiStrLen (AuthData->AuthConfig.CHAPSecret),
 247               AuthData->InChallenge,
 248               AuthData->InChallengeLength,
 249               AuthData->CHAPResponse
 250               );
 251
 252     //
 253     // Transit to next step.
 254     //
 255     Conn->CHAPStep = ISCSI_CHAP_STEP_THREE;
 256     break;
 257
 258   case ISCSI_CHAP_STEP_THREE:
 259     //
 260     // one way CHAP authentication and the target would like to
 261     // authenticate us.
 262     //
 263     Status = EFI_SUCCESS;
 264     break;
 265
 266   case ISCSI_CHAP_STEP_FOUR:
 267     ASSERT (AuthData->AuthConfig.CHAPType == ISCSI_CHAP_MUTUAL);
 268     //
 269     // The forth step, CHAP_N=<N> CHAP_R=<R> is received from Target.
 270     //
 271     Name = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_NAME);
 272     if (Name == NULL) {
 273       goto ON_EXIT;
 274     }
 275
 276     Response = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_RESPONSE);
 277     if (Response == NULL) {
 278       goto ON_EXIT;
 279     }
 280
 281     RspLen = ISCSI_CHAP_RSP_LEN;
 282     IScsiHexToBin (TargetRsp, &RspLen, Response);
 283
 284     //
 285     // Check the CHAP Response replied by Target.
 286     //
 287     Status = IScsiCHAPAuthTarget (AuthData, TargetRsp);
 288     break;
 289
 290   default:
 291     break;
 292   }
 293
 294 ON_EXIT:
 295
 296   IScsiFreeKeyValueList (KeyValueList);
 297
 298   gBS->FreePool (Data);
 299
 300   return Status;
 301 }
 302
 303 /**
 304   This function fills the CHAP authentication information into the login PDU
 305   during the security negotiation stage in the iSCSI connection login.
 306
 307   @param[in]       Conn        The iSCSI connection.
 308   @param[in, out]  Pdu         The PDU to send out.
 309
 310   @retval EFI_SUCCESS          All check passed and the phase-related CHAP
 311                                authentication info is filled into the iSCSI PDU.
 312   @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
 313   @retval EFI_PROTOCOL_ERROR   Some kind of protocol error happend.
 314 **/
 315 EFI_STATUS
 316 IScsiCHAPToSendReq (
 317   IN      ISCSI_CONNECTION  *Conn,
 318   IN OUT  NET_BUF           *Pdu
 319   )
 320 {
 321   EFI_STATUS                Status;
 322   ISCSI_SESSION             *Session;
 323   ISCSI_LOGIN_REQUEST       *LoginReq;
 324   ISCSI_CHAP_AUTH_DATA      *AuthData;
 325   CHAR8                     *Value;
 326   CHAR8                     ValueStr[256];
 327   CHAR8                     *Response;
 328   UINT32                    RspLen;
 329   CHAR8                     *Challenge;
 330   UINT32                    ChallengeLen;
 331
 332   ASSERT (Conn->CurrentStage == ISCSI_SECURITY_NEGOTIATION);
 333
 334   Session     = Conn->Session;
 335   AuthData    = &Session->AuthData;
 336   LoginReq    = (ISCSI_LOGIN_REQUEST *) NetbufGetByte (Pdu, 0, 0);
 337   Status      = EFI_SUCCESS;
 338
 339   RspLen      = 2 * ISCSI_CHAP_RSP_LEN + 3;
 340   Response    = AllocatePool (RspLen);
 341   if (Response == NULL) {
 342     return EFI_OUT_OF_RESOURCES;
 343   }
 344
 345   ChallengeLen  = 2 * ISCSI_CHAP_RSP_LEN + 3;
 346   Challenge     = AllocatePool (ChallengeLen);
 347   if (Challenge == NULL) {
 348     return EFI_OUT_OF_RESOURCES;
 349   }
 350
 351   switch (Conn->CHAPStep) {
 352   case ISCSI_CHAP_INITIAL:
 353     //
 354     // It's the initial Login Request. Fill in the key=value pairs mandatory
 355     // for the initial Login Request.
 356     //
 357     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_INITIATOR_NAME, Session->InitiatorName);
 358     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_SESSION_TYPE, "Normal");
 359     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_TARGET_NAME, Session->ConfigData.NvData.TargetName);
 360
 361     if (AuthData->AuthConfig.CHAPType == ISCSI_CHAP_NONE) {
 362       Value = ISCSI_KEY_VALUE_NONE;
 363       ISCSI_SET_FLAG (LoginReq, ISCSI_LOGIN_REQ_PDU_FLAG_TRANSIT);
 364     } else {
 365       Value = ISCSI_AUTH_METHOD_CHAP;
 366     }
 367
 368     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_AUTH_METHOD, Value);
 369
 370     break;
 371
 372   case ISCSI_CHAP_STEP_ONE:
 373     //
 374     // First step, send the Login Request with CHAP_A=<A1,A2...> key-value pair.
 375     //
 376     AsciiSPrint (ValueStr, sizeof (ValueStr), "%d", ISCSI_CHAP_ALGORITHM_MD5);
 377     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_ALGORITHM, ValueStr);
 378
 379     Conn->CHAPStep = ISCSI_CHAP_STEP_TWO;
 380     break;
 381
 382   case ISCSI_CHAP_STEP_THREE:
 383     //
 384     // Third step, send the Login Request with CHAP_N=<N> CHAP_R=<R> or
 385     // CHAP_N=<N> CHAP_R=<R> CHAP_I=<I> CHAP_C=<C> if target ahtentication is
 386     // required too.
 387     //
 388     // CHAP_N=<N>
 389     //
 390     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_NAME, (CHAR8 *) &AuthData->AuthConfig.CHAPName);
 391     //
 392     // CHAP_R=<R>
 393     //
 394     IScsiBinToHex ((UINT8 *) AuthData->CHAPResponse, ISCSI_CHAP_RSP_LEN, Response, &RspLen);
 395     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_RESPONSE, Response);
 396
 397     if (AuthData->AuthConfig.CHAPType == ISCSI_CHAP_MUTUAL) {
 398       //
 399       // CHAP_I=<I>
 400       //
 401       IScsiGenRandom ((UINT8 *) &AuthData->OutIdentifier, 1);
 402       AsciiSPrint (ValueStr, sizeof (ValueStr), "%d", AuthData->OutIdentifier);
 403       IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_IDENTIFIER, ValueStr);
 404       //
 405       // CHAP_C=<C>
 406       //
 407       IScsiGenRandom ((UINT8 *) AuthData->OutChallenge, ISCSI_CHAP_RSP_LEN);
 408       AuthData->OutChallengeLength = ISCSI_CHAP_RSP_LEN;
 409       IScsiBinToHex ((UINT8 *) AuthData->OutChallenge, ISCSI_CHAP_RSP_LEN, Challenge, &ChallengeLen);
 410       IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_CHALLENGE, Challenge);
 411
 412       Conn->CHAPStep = ISCSI_CHAP_STEP_FOUR;
 413     }
 414     //
 415     // set the stage transition flag.
 416     //
 417     ISCSI_SET_FLAG (LoginReq, ISCSI_LOGIN_REQ_PDU_FLAG_TRANSIT);
 418     break;
 419
 420   default:
 421     Status = EFI_PROTOCOL_ERROR;
 422     break;
 423   }
 424
 425   gBS->FreePool (Response);
 426   gBS->FreePool (Challenge);
 427
 428   return Status;
 429 }