MdeModulePkg/Universal/Network/IScsiDxe/IScsiCHAP.c

   1 /** @file
   2   This file is for Challenge-Handshake Authentication Protocol (CHAP) Configuration.
   3
   4 Copyright (c) 2004 - 2009, Intel Corporation.<BR>
   5 All rights reserved. This program and the accompanying materials
   6 are licensed and made available under the terms and conditions of the BSD License
   7 which accompanies this distribution.  The full text of the license may be found at
   8 http://opensource.org/licenses/bsd-license.php
   9
  10 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  11 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  12
  13 **/
  14
  15 #include "IScsiImpl.h"
  16 #include "Md5.h"
  17
  18 EFI_GUID  mIScsiCHAPAuthInfoGuid = ISCSI_CHAP_AUTH_INFO_GUID;
  19
  20 /**
  21   Initator caculates its own expected hash value.
  22
  23   @param[in]   ChapIdentifier     iSCSI CHAP identifier sent by authenticator.
  24   @param[in]   ChapSecret         iSCSI CHAP secret of the authenticator.
  25   @param[in]   SecretLength       The length of iSCSI CHAP secret.
  26   @param[in]   ChapChallenge      The challenge message sent by authenticator.
  27   @param[in]   ChallengeLength    The length of iSCSI CHAP challenge message.
  28   @param[out]  ChapResponse       The calculation of the expected hash value.
  29
  30   @retval EFI_SUCCESS             The expected hash value was caculatedly successfully.
  31   @retval EFI_PROTOCOL_ERROR      The length of the secret should be at least the
  32                                   length of the hash value for the hashing algorithm chosen.
  33   @retval Others                  Other errors as indicated.
  34 **/
  35 EFI_STATUS
  36 IScsiCHAPCalculateResponse (
  37   IN  UINT32  ChapIdentifier,
  38   IN  CHAR8   *ChapSecret,
  39   IN  UINT32  SecretLength,
  40   IN  UINT8   *ChapChallenge,
  41   IN  UINT32  ChallengeLength,
  42   OUT UINT8   *ChapResponse
  43   )
  44 {
  45   MD5_CTX     Md5Ctx;
  46   CHAR8       IdByte[1];
  47   EFI_STATUS  Status;
  48
  49   Status = MD5Init (&Md5Ctx);
  50
  51   //
  52   // Hash Identifier - Only calculate 1 byte data (RFC1994)
  53   //
  54   IdByte[0] = (CHAR8) ChapIdentifier;
  55   MD5Update (&Md5Ctx, IdByte, 1);
  56
  57   //
  58   // Hash Secret
  59   //
  60   if (SecretLength < ISCSI_CHAP_SECRET_MIN_LEN - 1) {
  61     return EFI_PROTOCOL_ERROR;
  62   }
  63
  64   MD5Update (&Md5Ctx, ChapSecret, SecretLength);
  65
  66   //
  67   // Hash Challenge received from Target
  68   //
  69   MD5Update (&Md5Ctx, ChapChallenge, ChallengeLength);
  70
  71   Status = MD5Final (&Md5Ctx, ChapResponse);
  72
  73   return Status;
  74 }
  75
  76 /**
  77   The initator checks the CHAP response replied by target against its own
  78   calculation of the expected hash value.
  79
  80   @param[in]   AuthData             iSCSI CHAP authentication data.
  81   @param[in]   TargetResponse       The response from target.
  82
  83   @retval EFI_SUCCESS               The response from target passed authentication.
  84   @retval EFI_SECURITY_VIOLATION    The response from target was not expected value.
  85   @retval Others                    Other errors as indicated.
  86 **/
  87 EFI_STATUS
  88 IScsiCHAPAuthTarget (
  89   IN  ISCSI_CHAP_AUTH_DATA  *AuthData,
  90   IN  UINT8                 *TargetResponse
  91   )
  92 {
  93   EFI_STATUS  Status;
  94   UINT32      SecretSize;
  95   UINT8       VerifyRsp[ISCSI_CHAP_RSP_LEN];
  96
  97   Status      = EFI_SUCCESS;
  98
  99   SecretSize  = (UINT32) AsciiStrLen (AuthData->AuthConfig.ReverseCHAPSecret);
 100   Status = IScsiCHAPCalculateResponse (
 101             AuthData->OutIdentifier,
 102             AuthData->AuthConfig.ReverseCHAPSecret,
 103             SecretSize,
 104             AuthData->OutChallenge,
 105             AuthData->OutChallengeLength,
 106             VerifyRsp
 107             );
 108
 109   if (CompareMem (VerifyRsp, TargetResponse, ISCSI_CHAP_RSP_LEN)) {
 110     Status = EFI_SECURITY_VIOLATION;
 111   }
 112
 113   return Status;
 114 }
 115
 116 /**
 117   This function checks the received iSCSI Login Response during the security
 118   negotiation stage.
 119
 120   @param[in] Conn             The iSCSI connection.
 121
 122   @retval EFI_SUCCESS          The Login Response passed the CHAP validation.
 123   @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
 124   @retval EFI_PROTOCOL_ERROR   Some kind of protocol error happend.
 125   @retval Others               Other errors as indicated.
 126 **/
 127 EFI_STATUS
 128 IScsiCHAPOnRspReceived (
 129   IN ISCSI_CONNECTION  *Conn
 130   )
 131 {
 132   EFI_STATUS                Status;
 133   ISCSI_SESSION             *Session;
 134   ISCSI_CHAP_AUTH_DATA      *AuthData;
 135   CHAR8                     *Value;
 136   UINT8                     *Data;
 137   UINT32                    Len;
 138   LIST_ENTRY                *KeyValueList;
 139   UINTN                     Algorithm;
 140   CHAR8                     *Identifier;
 141   CHAR8                     *Challenge;
 142   CHAR8                     *Name;
 143   CHAR8                     *Response;
 144   UINT8                     TargetRsp[ISCSI_CHAP_RSP_LEN];
 145   UINT32                    RspLen;
 146
 147   ASSERT (Conn->CurrentStage == ISCSI_SECURITY_NEGOTIATION);
 148   ASSERT (Conn->RspQue.BufNum != 0);
 149
 150   Session     = Conn->Session;
 151   AuthData    = &Session->AuthData;
 152
 153   Len         = Conn->RspQue.BufSize;
 154   Data        = AllocatePool (Len);
 155   if (Data == NULL) {
 156     return EFI_OUT_OF_RESOURCES;
 157   }
 158   //
 159   // Copy the data in case the data spans over multiple PDUs.
 160   //
 161   NetbufQueCopy (&Conn->RspQue, 0, Len, Data);
 162
 163   //
 164   // Build the key-value list from the data segment of the Login Response.
 165   //
 166   KeyValueList = IScsiBuildKeyValueList ((CHAR8 *) Data, Len);
 167   if (KeyValueList == NULL) {
 168     return EFI_OUT_OF_RESOURCES;
 169   }
 170
 171   Status = EFI_PROTOCOL_ERROR;
 172
 173   switch (Conn->CHAPStep) {
 174   case ISCSI_CHAP_INITIAL:
 175     //
 176     // The first Login Response.
 177     //
 178     Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_TARGET_PORTAL_GROUP_TAG);
 179     if (Value == NULL) {
 180       goto ON_EXIT;
 181     }
 182
 183     Session->TargetPortalGroupTag = (UINT16) AsciiStrDecimalToUintn (Value);
 184
 185     Value                         = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_AUTH_METHOD);
 186     if (Value == NULL) {
 187       goto ON_EXIT;
 188     }
 189     //
 190     // Initiator mandates CHAP authentication but target replies without "CHAP" or
 191     // initiator suggets "None" but target replies with some kind of auth method.
 192     //
 193     if (AsciiStrCmp (Value, ISCSI_AUTH_METHOD_CHAP) == 0) {
 194       if (AuthData->AuthConfig.CHAPType == ISCSI_CHAP_NONE) {
 195         goto ON_EXIT;
 196       }
 197     } else {
 198       if (AuthData->AuthConfig.CHAPType != ISCSI_CHAP_NONE) {
 199         goto ON_EXIT;
 200       }
 201     }
 202     //
 203     // Transit to CHAP step one.
 204     //
 205     Conn->CHAPStep  = ISCSI_CHAP_STEP_ONE;
 206     Status          = EFI_SUCCESS;
 207     break;
 208
 209   case ISCSI_CHAP_STEP_TWO:
 210     //
 211     // The Target replies with CHAP_A=<A> CHAP_I=<I> CHAP_C=<C>
 212     //
 213     Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_ALGORITHM);
 214     if (Value == NULL) {
 215       goto ON_EXIT;
 216     }
 217
 218     Algorithm = AsciiStrDecimalToUintn (Value);
 219     if (Algorithm != ISCSI_CHAP_ALGORITHM_MD5) {
 220       //
 221       // Unsupported algorithm is chosen by target.
 222       //
 223       goto ON_EXIT;
 224     }
 225
 226     Identifier = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_IDENTIFIER);
 227     if (Identifier == NULL) {
 228       goto ON_EXIT;
 229     }
 230
 231     Challenge = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_CHALLENGE);
 232     if (Challenge == NULL) {
 233       goto ON_EXIT;
 234     }
 235     //
 236     // Process the CHAP identifier and CHAP Challenge from Target
 237     // Calculate Response value
 238     //
 239     AuthData->InIdentifier      = (UINT32) AsciiStrDecimalToUintn (Identifier);
 240     AuthData->InChallengeLength = ISCSI_CHAP_AUTH_MAX_LEN;
 241     IScsiHexToBin ((UINT8 *) AuthData->InChallenge, &AuthData->InChallengeLength, Challenge);
 242     Status = IScsiCHAPCalculateResponse (
 243               AuthData->InIdentifier,
 244               AuthData->AuthConfig.CHAPSecret,
 245               (UINT32) AsciiStrLen (AuthData->AuthConfig.CHAPSecret),
 246               AuthData->InChallenge,
 247               AuthData->InChallengeLength,
 248               AuthData->CHAPResponse
 249               );
 250
 251     //
 252     // Transit to next step.
 253     //
 254     Conn->CHAPStep = ISCSI_CHAP_STEP_THREE;
 255     break;
 256
 257   case ISCSI_CHAP_STEP_THREE:
 258     //
 259     // one way CHAP authentication and the target would like to
 260     // authenticate us.
 261     //
 262     Status = EFI_SUCCESS;
 263     break;
 264
 265   case ISCSI_CHAP_STEP_FOUR:
 266     ASSERT (AuthData->AuthConfig.CHAPType == ISCSI_CHAP_MUTUAL);
 267     //
 268     // The forth step, CHAP_N=<N> CHAP_R=<R> is received from Target.
 269     //
 270     Name = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_NAME);
 271     if (Name == NULL) {
 272       goto ON_EXIT;
 273     }
 274
 275     Response = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_RESPONSE);
 276     if (Response == NULL) {
 277       goto ON_EXIT;
 278     }
 279
 280     RspLen = ISCSI_CHAP_RSP_LEN;
 281     IScsiHexToBin (TargetRsp, &RspLen, Response);
 282
 283     //
 284     // Check the CHAP Response replied by Target.
 285     //
 286     Status = IScsiCHAPAuthTarget (AuthData, TargetRsp);
 287     break;
 288
 289   default:
 290     break;
 291   }
 292
 293 ON_EXIT:
 294
 295   IScsiFreeKeyValueList (KeyValueList);
 296
 297   gBS->FreePool (Data);
 298
 299   return Status;
 300 }
 301
 302 /**
 303   This function fills the CHAP authentication information into the login PDU
 304   during the security negotiation stage in the iSCSI connection login.
 305
 306   @param[in]       Conn        The iSCSI connection.
 307   @param[in, out]  Pdu         The PDU to send out.
 308
 309   @retval EFI_SUCCESS          All check passed and the phase-related CHAP
 310                                authentication info is filled into the iSCSI PDU.
 311   @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
 312   @retval EFI_PROTOCOL_ERROR   Some kind of protocol error happend.
 313 **/
 314 EFI_STATUS
 315 IScsiCHAPToSendReq (
 316   IN      ISCSI_CONNECTION  *Conn,
 317   IN OUT  NET_BUF           *Pdu
 318   )
 319 {
 320   EFI_STATUS                Status;
 321   ISCSI_SESSION             *Session;
 322   ISCSI_LOGIN_REQUEST       *LoginReq;
 323   ISCSI_CHAP_AUTH_DATA      *AuthData;
 324   CHAR8                     *Value;
 325   CHAR8                     ValueStr[256];
 326   CHAR8                     *Response;
 327   UINT32                    RspLen;
 328   CHAR8                     *Challenge;
 329   UINT32                    ChallengeLen;
 330
 331   ASSERT (Conn->CurrentStage == ISCSI_SECURITY_NEGOTIATION);
 332
 333   Session     = Conn->Session;
 334   AuthData    = &Session->AuthData;
 335   LoginReq    = (ISCSI_LOGIN_REQUEST *) NetbufGetByte (Pdu, 0, 0);
 336   Status      = EFI_SUCCESS;
 337
 338   RspLen      = 2 * ISCSI_CHAP_RSP_LEN + 3;
 339   Response    = AllocatePool (RspLen);
 340   if (Response == NULL) {
 341     return EFI_OUT_OF_RESOURCES;
 342   }
 343
 344   ChallengeLen  = 2 * ISCSI_CHAP_RSP_LEN + 3;
 345   Challenge     = AllocatePool (ChallengeLen);
 346   if (Challenge == NULL) {
 347     return EFI_OUT_OF_RESOURCES;
 348   }
 349
 350   switch (Conn->CHAPStep) {
 351   case ISCSI_CHAP_INITIAL:
 352     //
 353     // It's the initial Login Request. Fill in the key=value pairs mandatory
 354     // for the initial Login Request.
 355     //
 356     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_INITIATOR_NAME, Session->InitiatorName);
 357     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_SESSION_TYPE, "Normal");
 358     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_TARGET_NAME, Session->ConfigData.NvData.TargetName);
 359
 360     if (AuthData->AuthConfig.CHAPType == ISCSI_CHAP_NONE) {
 361       Value = ISCSI_KEY_VALUE_NONE;
 362       ISCSI_SET_FLAG (LoginReq, ISCSI_LOGIN_REQ_PDU_FLAG_TRANSIT);
 363     } else {
 364       Value = ISCSI_AUTH_METHOD_CHAP;
 365     }
 366
 367     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_AUTH_METHOD, Value);
 368
 369     break;
 370
 371   case ISCSI_CHAP_STEP_ONE:
 372     //
 373     // First step, send the Login Request with CHAP_A=<A1,A2...> key-value pair.
 374     //
 375     AsciiSPrint (ValueStr, sizeof (ValueStr), "%d", ISCSI_CHAP_ALGORITHM_MD5);
 376     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_ALGORITHM, ValueStr);
 377
 378     Conn->CHAPStep = ISCSI_CHAP_STEP_TWO;
 379     break;
 380
 381   case ISCSI_CHAP_STEP_THREE:
 382     //
 383     // Third step, send the Login Request with CHAP_N=<N> CHAP_R=<R> or
 384     // CHAP_N=<N> CHAP_R=<R> CHAP_I=<I> CHAP_C=<C> if target ahtentication is
 385     // required too.
 386     //
 387     // CHAP_N=<N>
 388     //
 389     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_NAME, (CHAR8 *) &AuthData->AuthConfig.CHAPName);
 390     //
 391     // CHAP_R=<R>
 392     //
 393     IScsiBinToHex ((UINT8 *) AuthData->CHAPResponse, ISCSI_CHAP_RSP_LEN, Response, &RspLen);
 394     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_RESPONSE, Response);
 395
 396     if (AuthData->AuthConfig.CHAPType == ISCSI_CHAP_MUTUAL) {
 397       //
 398       // CHAP_I=<I>
 399       //
 400       IScsiGenRandom ((UINT8 *) &AuthData->OutIdentifier, 1);
 401       AsciiSPrint (ValueStr, sizeof (ValueStr), "%d", AuthData->OutIdentifier);
 402       IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_IDENTIFIER, ValueStr);
 403       //
 404       // CHAP_C=<C>
 405       //
 406       IScsiGenRandom ((UINT8 *) AuthData->OutChallenge, ISCSI_CHAP_RSP_LEN);
 407       AuthData->OutChallengeLength = ISCSI_CHAP_RSP_LEN;
 408       IScsiBinToHex ((UINT8 *) AuthData->OutChallenge, ISCSI_CHAP_RSP_LEN, Challenge, &ChallengeLen);
 409       IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_CHALLENGE, Challenge);
 410
 411       Conn->CHAPStep = ISCSI_CHAP_STEP_FOUR;
 412     }
 413     //
 414     // set the stage transition flag.
 415     //
 416     ISCSI_SET_FLAG (LoginReq, ISCSI_LOGIN_REQ_PDU_FLAG_TRANSIT);
 417     break;
 418
 419   default:
 420     Status = EFI_PROTOCOL_ERROR;
 421     break;
 422   }
 423
 424   gBS->FreePool (Response);
 425   gBS->FreePool (Challenge);
 426
 427   return Status;
 428 }