NetworkPkg/IScsiDxe/IScsiCHAP.c

   1 /** @file
   2   This file is for Challenge-Handshake Authentication Protocol (CHAP) Configuration.
   3
   4 Copyright (c) 2004 - 2011, Intel Corporation. All rights reserved.<BR>
   5 This program and the accompanying materials
   6 are licensed and made available under the terms and conditions of the BSD License
   7 which accompanies this distribution.  The full text of the license may be found at
   8 http://opensource.org/licenses/bsd-license.php
   9
  10 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  11 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  12
  13 **/
  14
  15 #include "IScsiImpl.h"
  16
  17 /**
  18   Initator caculates its own expected hash value.
  19
  20   @param[in]   ChapIdentifier     iSCSI CHAP identifier sent by authenticator.
  21   @param[in]   ChapSecret         iSCSI CHAP secret of the authenticator.
  22   @param[in]   SecretLength       The length of iSCSI CHAP secret.
  23   @param[in]   ChapChallenge      The challenge message sent by authenticator.
  24   @param[in]   ChallengeLength    The length of iSCSI CHAP challenge message.
  25   @param[out]  ChapResponse       The calculation of the expected hash value.
  26
  27   @retval EFI_SUCCESS             The expected hash value was caculatedly successfully.
  28   @retval EFI_PROTOCOL_ERROR      The length of the secret should be at least the
  29                                   length of the hash value for the hashing algorithm chosen.
  30   @retval EFI_PROTOCOL_ERROR      MD5 hash operation fail.
  31   @retval EFI_OUT_OF_RESOURCES    Fail to allocate resource to complete MD5.
  32
  33 **/
  34 EFI_STATUS
  35 IScsiCHAPCalculateResponse (
  36   IN  UINT32  ChapIdentifier,
  37   IN  CHAR8   *ChapSecret,
  38   IN  UINT32  SecretLength,
  39   IN  UINT8   *ChapChallenge,
  40   IN  UINT32  ChallengeLength,
  41   OUT UINT8   *ChapResponse
  42   )
  43 {
  44   UINTN       Md5ContextSize;
  45   VOID        *Md5Ctx;
  46   CHAR8       IdByte[1];
  47   EFI_STATUS  Status;
  48
  49   if (SecretLength < ISCSI_CHAP_SECRET_MIN_LEN) {
  50     return EFI_PROTOCOL_ERROR;
  51   }
  52
  53   Md5ContextSize = Md5GetContextSize ();
  54   Md5Ctx = AllocatePool (Md5ContextSize);
  55   if (Md5Ctx == NULL) {
  56     return EFI_OUT_OF_RESOURCES;
  57   }
  58
  59   Status = EFI_PROTOCOL_ERROR;
  60
  61   if (!Md5Init (Md5Ctx)) {
  62     goto Exit;
  63   }
  64
  65   //
  66   // Hash Identifier - Only calculate 1 byte data (RFC1994)
  67   //
  68   IdByte[0] = (CHAR8) ChapIdentifier;
  69   if (!Md5Update (Md5Ctx, IdByte, 1)) {
  70     goto Exit;
  71   }
  72
  73   //
  74   // Hash Secret
  75   //
  76   if (!Md5Update (Md5Ctx, ChapSecret, SecretLength)) {
  77     goto Exit;
  78   }
  79
  80   //
  81   // Hash Challenge received from Target
  82   //
  83   if (!Md5Update (Md5Ctx, ChapChallenge, ChallengeLength)) {
  84     goto Exit;
  85   }
  86
  87   if (Md5Final (Md5Ctx, ChapResponse)) {
  88     Status = EFI_SUCCESS;
  89   }
  90
  91 Exit:
  92   FreePool (Md5Ctx);
  93   return Status;
  94 }
  95
  96 /**
  97   The initator checks the CHAP response replied by target against its own
  98   calculation of the expected hash value.
  99
 100   @param[in]   AuthData             iSCSI CHAP authentication data.
 101   @param[in]   TargetResponse       The response from target.
 102
 103   @retval EFI_SUCCESS               The response from target passed authentication.
 104   @retval EFI_SECURITY_VIOLATION    The response from target was not expected value.
 105   @retval Others                    Other errors as indicated.
 106
 107 **/
 108 EFI_STATUS
 109 IScsiCHAPAuthTarget (
 110   IN  ISCSI_CHAP_AUTH_DATA  *AuthData,
 111   IN  UINT8                 *TargetResponse
 112   )
 113 {
 114   EFI_STATUS  Status;
 115   UINT32      SecretSize;
 116   UINT8       VerifyRsp[ISCSI_CHAP_RSP_LEN];
 117
 118   Status      = EFI_SUCCESS;
 119
 120   SecretSize  = (UINT32) AsciiStrLen (AuthData->AuthConfig->ReverseCHAPSecret);
 121   Status = IScsiCHAPCalculateResponse (
 122              AuthData->OutIdentifier,
 123              AuthData->AuthConfig->ReverseCHAPSecret,
 124              SecretSize,
 125              AuthData->OutChallenge,
 126              AuthData->OutChallengeLength,
 127              VerifyRsp
 128              );
 129
 130   if (CompareMem (VerifyRsp, TargetResponse, ISCSI_CHAP_RSP_LEN) != 0) {
 131     Status = EFI_SECURITY_VIOLATION;
 132   }
 133
 134   return Status;
 135 }
 136
 137
 138 /**
 139   This function checks the received iSCSI Login Response during the security
 140   negotiation stage.
 141
 142   @param[in] Conn             The iSCSI connection.
 143
 144   @retval EFI_SUCCESS          The Login Response passed the CHAP validation.
 145   @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
 146   @retval EFI_PROTOCOL_ERROR   Some kind of protocol error occurred.
 147   @retval Others               Other errors as indicated.
 148
 149 **/
 150 EFI_STATUS
 151 IScsiCHAPOnRspReceived (
 152   IN ISCSI_CONNECTION  *Conn
 153   )
 154 {
 155   EFI_STATUS                  Status;
 156   ISCSI_SESSION               *Session;
 157   ISCSI_CHAP_AUTH_DATA        *AuthData;
 158   CHAR8                       *Value;
 159   UINT8                       *Data;
 160   UINT32                      Len;
 161   LIST_ENTRY                  *KeyValueList;
 162   UINTN                       Algorithm;
 163   CHAR8                       *Identifier;
 164   CHAR8                       *Challenge;
 165   CHAR8                       *Name;
 166   CHAR8                       *Response;
 167   UINT8                       TargetRsp[ISCSI_CHAP_RSP_LEN];
 168   UINT32                      RspLen;
 169   UINTN                       Result;
 170
 171   ASSERT (Conn->CurrentStage == ISCSI_SECURITY_NEGOTIATION);
 172   ASSERT (Conn->RspQue.BufNum != 0);
 173
 174   Session     = Conn->Session;
 175   AuthData    = &Session->AuthData.CHAP;
 176   Len         = Conn->RspQue.BufSize;
 177   Data        = AllocateZeroPool (Len);
 178   if (Data == NULL) {
 179     return EFI_OUT_OF_RESOURCES;
 180   }
 181   //
 182   // Copy the data in case the data spans over multiple PDUs.
 183   //
 184   NetbufQueCopy (&Conn->RspQue, 0, Len, Data);
 185
 186   //
 187   // Build the key-value list from the data segment of the Login Response.
 188   //
 189   KeyValueList = IScsiBuildKeyValueList ((CHAR8 *) Data, Len);
 190   if (KeyValueList == NULL) {
 191     Status = EFI_OUT_OF_RESOURCES;
 192     goto ON_EXIT;
 193   }
 194
 195   Status = EFI_PROTOCOL_ERROR;
 196
 197   switch (Conn->AuthStep) {
 198   case ISCSI_AUTH_INITIAL:
 199     //
 200     // The first Login Response.
 201     //
 202     Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_TARGET_PORTAL_GROUP_TAG);
 203     if (Value == NULL) {
 204       goto ON_EXIT;
 205     }
 206
 207     Result = IScsiNetNtoi (Value);
 208     if (Result > 0xFFFF) {
 209       goto ON_EXIT;
 210     }
 211
 212     Session->TargetPortalGroupTag = (UINT16) Result;
 213
 214     Value                         = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_AUTH_METHOD);
 215     if (Value == NULL) {
 216       goto ON_EXIT;
 217     }
 218     //
 219     // Initiator mandates CHAP authentication but target replies without "CHAP", or
 220     // initiator suggets "None" but target replies with some kind of auth method.
 221     //
 222     if (Session->AuthType == ISCSI_AUTH_TYPE_NONE) {
 223       if (AsciiStrCmp (Value, ISCSI_KEY_VALUE_NONE) != 0) {
 224         goto ON_EXIT;
 225       }
 226     } else if (Session->AuthType == ISCSI_AUTH_TYPE_CHAP) {
 227       if (AsciiStrCmp (Value, ISCSI_AUTH_METHOD_CHAP) != 0) {
 228         goto ON_EXIT;
 229       }
 230     } else {
 231       goto ON_EXIT;
 232     }
 233
 234     //
 235     // Transit to CHAP step one.
 236     //
 237     Conn->AuthStep  = ISCSI_CHAP_STEP_ONE;
 238     Status          = EFI_SUCCESS;
 239     break;
 240
 241   case ISCSI_CHAP_STEP_TWO:
 242     //
 243     // The Target replies with CHAP_A=<A> CHAP_I=<I> CHAP_C=<C>
 244     //
 245     Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_ALGORITHM);
 246     if (Value == NULL) {
 247       goto ON_EXIT;
 248     }
 249
 250     Algorithm = IScsiNetNtoi (Value);
 251     if (Algorithm != ISCSI_CHAP_ALGORITHM_MD5) {
 252       //
 253       // Unsupported algorithm is chosen by target.
 254       //
 255       goto ON_EXIT;
 256     }
 257
 258     Identifier = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_IDENTIFIER);
 259     if (Identifier == NULL) {
 260       goto ON_EXIT;
 261     }
 262
 263     Challenge = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_CHALLENGE);
 264     if (Challenge == NULL) {
 265       goto ON_EXIT;
 266     }
 267     //
 268     // Process the CHAP identifier and CHAP Challenge from Target.
 269     // Calculate Response value.
 270     //
 271     Result = IScsiNetNtoi (Identifier);
 272     if (Result > 0xFF) {
 273       goto ON_EXIT;
 274     }
 275
 276     AuthData->InIdentifier      = (UINT32) Result;
 277     AuthData->InChallengeLength = ISCSI_CHAP_AUTH_MAX_LEN;
 278     IScsiHexToBin ((UINT8 *) AuthData->InChallenge, &AuthData->InChallengeLength, Challenge);
 279     Status = IScsiCHAPCalculateResponse (
 280                AuthData->InIdentifier,
 281                AuthData->AuthConfig->CHAPSecret,
 282                (UINT32) AsciiStrLen (AuthData->AuthConfig->CHAPSecret),
 283                AuthData->InChallenge,
 284                AuthData->InChallengeLength,
 285                AuthData->CHAPResponse
 286                );
 287
 288     //
 289     // Transit to next step.
 290     //
 291     Conn->AuthStep = ISCSI_CHAP_STEP_THREE;
 292     break;
 293
 294   case ISCSI_CHAP_STEP_THREE:
 295     //
 296     // One way CHAP authentication and the target would like to
 297     // authenticate us.
 298     //
 299     Status = EFI_SUCCESS;
 300     break;
 301
 302   case ISCSI_CHAP_STEP_FOUR:
 303     ASSERT (AuthData->AuthConfig->CHAPType == ISCSI_CHAP_MUTUAL);
 304     //
 305     // The forth step, CHAP_N=<N> CHAP_R=<R> is received from Target.
 306     //
 307     Name = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_NAME);
 308     if (Name == NULL) {
 309       goto ON_EXIT;
 310     }
 311
 312     Response = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_RESPONSE);
 313     if (Response == NULL) {
 314       goto ON_EXIT;
 315     }
 316
 317     RspLen = ISCSI_CHAP_RSP_LEN;
 318     IScsiHexToBin (TargetRsp, &RspLen, Response);
 319
 320     //
 321     // Check the CHAP Name and Response replied by Target.
 322     //
 323     Status = IScsiCHAPAuthTarget (AuthData, TargetRsp);
 324     break;
 325
 326   default:
 327     break;
 328   }
 329
 330 ON_EXIT:
 331
 332   if (KeyValueList != NULL) {
 333     IScsiFreeKeyValueList (KeyValueList);
 334   }
 335
 336   FreePool (Data);
 337
 338   return Status;
 339 }
 340
 341
 342 /**
 343   This function fills the CHAP authentication information into the login PDU
 344   during the security negotiation stage in the iSCSI connection login.
 345
 346   @param[in]       Conn        The iSCSI connection.
 347   @param[in, out]  Pdu         The PDU to send out.
 348
 349   @retval EFI_SUCCESS           All check passed and the phase-related CHAP
 350                                 authentication info is filled into the iSCSI PDU.
 351   @retval EFI_OUT_OF_RESOURCES  Failed to allocate memory.
 352   @retval EFI_PROTOCOL_ERROR    Some kind of protocol error occurred.
 353
 354 **/
 355 EFI_STATUS
 356 IScsiCHAPToSendReq (
 357   IN      ISCSI_CONNECTION  *Conn,
 358   IN OUT  NET_BUF           *Pdu
 359   )
 360 {
 361   EFI_STATUS                  Status;
 362   ISCSI_SESSION               *Session;
 363   ISCSI_LOGIN_REQUEST         *LoginReq;
 364   ISCSI_CHAP_AUTH_DATA        *AuthData;
 365   CHAR8                       *Value;
 366   CHAR8                       ValueStr[256];
 367   CHAR8                       *Response;
 368   UINT32                      RspLen;
 369   CHAR8                       *Challenge;
 370   UINT32                      ChallengeLen;
 371
 372   ASSERT (Conn->CurrentStage == ISCSI_SECURITY_NEGOTIATION);
 373
 374   Session     = Conn->Session;
 375   AuthData    = &Session->AuthData.CHAP;
 376   LoginReq    = (ISCSI_LOGIN_REQUEST *) NetbufGetByte (Pdu, 0, 0);
 377   Status      = EFI_SUCCESS;
 378
 379   RspLen      = 2 * ISCSI_CHAP_RSP_LEN + 3;
 380   Response    = AllocateZeroPool (RspLen);
 381   if (Response == NULL) {
 382     return EFI_OUT_OF_RESOURCES;
 383   }
 384
 385   ChallengeLen  = 2 * ISCSI_CHAP_RSP_LEN + 3;
 386   Challenge     = AllocateZeroPool (ChallengeLen);
 387   if (Challenge == NULL) {
 388     FreePool (Response);
 389     return EFI_OUT_OF_RESOURCES;
 390   }
 391
 392   switch (Conn->AuthStep) {
 393   case ISCSI_AUTH_INITIAL:
 394     //
 395     // It's the initial Login Request. Fill in the key=value pairs mandatory
 396     // for the initial Login Request.
 397     //
 398     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_INITIATOR_NAME, mPrivate->InitiatorName);
 399     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_SESSION_TYPE, "Normal");
 400     IScsiAddKeyValuePair (
 401       Pdu,
 402       ISCSI_KEY_TARGET_NAME,
 403       Session->ConfigData->SessionConfigData.TargetName
 404       );
 405
 406     if (Session->AuthType == ISCSI_AUTH_TYPE_NONE) {
 407       Value = ISCSI_KEY_VALUE_NONE;
 408       ISCSI_SET_FLAG (LoginReq, ISCSI_LOGIN_REQ_PDU_FLAG_TRANSIT);
 409     } else {
 410       Value = ISCSI_AUTH_METHOD_CHAP;
 411     }
 412
 413     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_AUTH_METHOD, Value);
 414
 415     break;
 416
 417   case ISCSI_CHAP_STEP_ONE:
 418     //
 419     // First step, send the Login Request with CHAP_A=<A1,A2...> key-value pair.
 420     //
 421     AsciiSPrint (ValueStr, sizeof (ValueStr), "%d", ISCSI_CHAP_ALGORITHM_MD5);
 422     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_ALGORITHM, ValueStr);
 423
 424     Conn->AuthStep = ISCSI_CHAP_STEP_TWO;
 425     break;
 426
 427   case ISCSI_CHAP_STEP_THREE:
 428     //
 429     // Third step, send the Login Request with CHAP_N=<N> CHAP_R=<R> or
 430     // CHAP_N=<N> CHAP_R=<R> CHAP_I=<I> CHAP_C=<C> if target authentication is
 431     // required too.
 432     //
 433     // CHAP_N=<N>
 434     //
 435     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_NAME, (CHAR8 *) &AuthData->AuthConfig->CHAPName);
 436     //
 437     // CHAP_R=<R>
 438     //
 439     IScsiBinToHex ((UINT8 *) AuthData->CHAPResponse, ISCSI_CHAP_RSP_LEN, Response, &RspLen);
 440     IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_RESPONSE, Response);
 441
 442     if (AuthData->AuthConfig->CHAPType == ISCSI_CHAP_MUTUAL) {
 443       //
 444       // CHAP_I=<I>
 445       //
 446       IScsiGenRandom ((UINT8 *) &AuthData->OutIdentifier, 1);
 447       AsciiSPrint (ValueStr, sizeof (ValueStr), "%d", AuthData->OutIdentifier);
 448       IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_IDENTIFIER, ValueStr);
 449       //
 450       // CHAP_C=<C>
 451       //
 452       IScsiGenRandom ((UINT8 *) AuthData->OutChallenge, ISCSI_CHAP_RSP_LEN);
 453       AuthData->OutChallengeLength = ISCSI_CHAP_RSP_LEN;
 454       IScsiBinToHex ((UINT8 *) AuthData->OutChallenge, ISCSI_CHAP_RSP_LEN, Challenge, &ChallengeLen);
 455       IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_CHALLENGE, Challenge);
 456
 457       Conn->AuthStep = ISCSI_CHAP_STEP_FOUR;
 458     }
 459     //
 460     // Set the stage transition flag.
 461     //
 462     ISCSI_SET_FLAG (LoginReq, ISCSI_LOGIN_REQ_PDU_FLAG_TRANSIT);
 463     break;
 464
 465   default:
 466     Status = EFI_PROTOCOL_ERROR;
 467     break;
 468   }
 469
 470   FreePool (Response);
 471   FreePool (Challenge);
 472
 473   return Status;
 474 }