1 /*******************************************************************************
2 * This file houses the main functions for the iSCSI CHAP support
4 * (c) Copyright 2007-2013 Datera, Inc.
6 * Author: Nicholas A. Bellinger <nab@linux-iscsi.org>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 ******************************************************************************/
19 #include <linux/kernel.h>
20 #include <linux/string.h>
21 #include <linux/crypto.h>
22 #include <linux/err.h>
23 #include <linux/scatterlist.h>
25 #include "iscsi_target_core.h"
26 #include "iscsi_target_nego.h"
27 #include "iscsi_target_auth.h"
29 static int chap_string_to_hex(unsigned char *dst
, unsigned char *src
, int len
)
31 int j
= DIV_ROUND_UP(len
, 2), rc
;
33 rc
= hex2bin(dst
, src
, j
);
35 pr_debug("CHAP string contains non hex digit symbols\n");
41 static void chap_binaryhex_to_asciihex(char *dst
, char *src
, int src_len
)
45 for (i
= 0; i
< src_len
; i
++) {
46 sprintf(&dst
[i
*2], "%02x", (int) src
[i
] & 0xff);
50 static void chap_gen_challenge(
51 struct iscsi_conn
*conn
,
56 unsigned char challenge_asciihex
[CHAP_CHALLENGE_LENGTH
* 2 + 1];
57 struct iscsi_chap
*chap
= conn
->auth_protocol
;
59 memset(challenge_asciihex
, 0, CHAP_CHALLENGE_LENGTH
* 2 + 1);
61 get_random_bytes(chap
->challenge
, CHAP_CHALLENGE_LENGTH
);
62 chap_binaryhex_to_asciihex(challenge_asciihex
, chap
->challenge
,
63 CHAP_CHALLENGE_LENGTH
);
65 * Set CHAP_C, and copy the generated challenge into c_str.
67 *c_len
+= sprintf(c_str
+ *c_len
, "CHAP_C=0x%s", challenge_asciihex
);
70 pr_debug("[%s] Sending CHAP_C=0x%s\n\n", (caller
) ? "server" : "client",
75 static struct iscsi_chap
*chap_server_open(
76 struct iscsi_conn
*conn
,
77 struct iscsi_node_auth
*auth
,
80 unsigned int *aic_len
)
82 struct iscsi_chap
*chap
;
84 if (!(auth
->naf_flags
& NAF_USERID_SET
) ||
85 !(auth
->naf_flags
& NAF_PASSWORD_SET
)) {
86 pr_err("CHAP user or password not set for"
91 conn
->auth_protocol
= kzalloc(sizeof(struct iscsi_chap
), GFP_KERNEL
);
92 if (!conn
->auth_protocol
)
95 chap
= conn
->auth_protocol
;
97 * We only support MD5 MDA presently.
99 if (strncmp(a_str
, "CHAP_A=5", 8)) {
100 pr_err("CHAP_A is not MD5.\n");
103 pr_debug("[server] Got CHAP_A=5\n");
105 * Send back CHAP_A set to MD5.
107 *aic_len
= sprintf(aic_str
, "CHAP_A=5");
109 chap
->digest_type
= CHAP_DIGEST_MD5
;
110 pr_debug("[server] Sending CHAP_A=%d\n", chap
->digest_type
);
114 chap
->id
= ISCSI_TPG_C(conn
)->tpg_chap_id
++;
115 *aic_len
+= sprintf(aic_str
+ *aic_len
, "CHAP_I=%d", chap
->id
);
117 pr_debug("[server] Sending CHAP_I=%d\n", chap
->id
);
119 * Generate Challenge.
121 chap_gen_challenge(conn
, 1, aic_str
, aic_len
);
126 static void chap_close(struct iscsi_conn
*conn
)
128 kfree(conn
->auth_protocol
);
129 conn
->auth_protocol
= NULL
;
132 static int chap_server_compute_md5(
133 struct iscsi_conn
*conn
,
134 struct iscsi_node_auth
*auth
,
137 unsigned int *nr_out_len
)
141 unsigned char id_as_uchar
;
142 unsigned char digest
[MD5_SIGNATURE_SIZE
];
143 unsigned char type
, response
[MD5_SIGNATURE_SIZE
* 2 + 2];
144 unsigned char identifier
[10], *challenge
= NULL
;
145 unsigned char *challenge_binhex
= NULL
;
146 unsigned char client_digest
[MD5_SIGNATURE_SIZE
];
147 unsigned char server_digest
[MD5_SIGNATURE_SIZE
];
148 unsigned char chap_n
[MAX_CHAP_N_SIZE
], chap_r
[MAX_RESPONSE_LENGTH
];
149 struct iscsi_chap
*chap
= conn
->auth_protocol
;
150 struct crypto_hash
*tfm
;
151 struct hash_desc desc
;
152 struct scatterlist sg
;
153 int auth_ret
= -1, ret
, challenge_len
;
155 memset(identifier
, 0, 10);
156 memset(chap_n
, 0, MAX_CHAP_N_SIZE
);
157 memset(chap_r
, 0, MAX_RESPONSE_LENGTH
);
158 memset(digest
, 0, MD5_SIGNATURE_SIZE
);
159 memset(response
, 0, MD5_SIGNATURE_SIZE
* 2 + 2);
160 memset(client_digest
, 0, MD5_SIGNATURE_SIZE
);
161 memset(server_digest
, 0, MD5_SIGNATURE_SIZE
);
163 challenge
= kzalloc(CHAP_CHALLENGE_STR_LEN
, GFP_KERNEL
);
165 pr_err("Unable to allocate challenge buffer\n");
169 challenge_binhex
= kzalloc(CHAP_CHALLENGE_STR_LEN
, GFP_KERNEL
);
170 if (!challenge_binhex
) {
171 pr_err("Unable to allocate challenge_binhex buffer\n");
177 if (extract_param(nr_in_ptr
, "CHAP_N", MAX_CHAP_N_SIZE
, chap_n
,
179 pr_err("Could not find CHAP_N.\n");
183 pr_err("Could not find CHAP_N.\n");
187 if (memcmp(chap_n
, auth
->userid
, strlen(auth
->userid
)) != 0) {
188 pr_err("CHAP_N values do not match!\n");
191 pr_debug("[server] Got CHAP_N=%s\n", chap_n
);
195 if (extract_param(nr_in_ptr
, "CHAP_R", MAX_RESPONSE_LENGTH
, chap_r
,
197 pr_err("Could not find CHAP_R.\n");
201 pr_err("Could not find CHAP_R.\n");
205 pr_debug("[server] Got CHAP_R=%s\n", chap_r
);
206 chap_string_to_hex(client_digest
, chap_r
, strlen(chap_r
));
208 tfm
= crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC
);
210 pr_err("Unable to allocate struct crypto_hash\n");
216 ret
= crypto_hash_init(&desc
);
218 pr_err("crypto_hash_init() failed\n");
219 crypto_free_hash(tfm
);
223 sg_init_one(&sg
, &chap
->id
, 1);
224 ret
= crypto_hash_update(&desc
, &sg
, 1);
226 pr_err("crypto_hash_update() failed for id\n");
227 crypto_free_hash(tfm
);
231 sg_init_one(&sg
, &auth
->password
, strlen(auth
->password
));
232 ret
= crypto_hash_update(&desc
, &sg
, strlen(auth
->password
));
234 pr_err("crypto_hash_update() failed for password\n");
235 crypto_free_hash(tfm
);
239 sg_init_one(&sg
, chap
->challenge
, CHAP_CHALLENGE_LENGTH
);
240 ret
= crypto_hash_update(&desc
, &sg
, CHAP_CHALLENGE_LENGTH
);
242 pr_err("crypto_hash_update() failed for challenge\n");
243 crypto_free_hash(tfm
);
247 ret
= crypto_hash_final(&desc
, server_digest
);
249 pr_err("crypto_hash_final() failed for server digest\n");
250 crypto_free_hash(tfm
);
253 crypto_free_hash(tfm
);
255 chap_binaryhex_to_asciihex(response
, server_digest
, MD5_SIGNATURE_SIZE
);
256 pr_debug("[server] MD5 Server Digest: %s\n", response
);
258 if (memcmp(server_digest
, client_digest
, MD5_SIGNATURE_SIZE
) != 0) {
259 pr_debug("[server] MD5 Digests do not match!\n\n");
262 pr_debug("[server] MD5 Digests match, CHAP connetication"
265 * One way authentication has succeeded, return now if mutual
266 * authentication is not enabled.
268 if (!auth
->authenticate_target
) {
270 kfree(challenge_binhex
);
276 if (extract_param(nr_in_ptr
, "CHAP_I", 10, identifier
, &type
) < 0) {
277 pr_err("Could not find CHAP_I.\n");
282 id
= simple_strtoul(&identifier
[2], &endptr
, 0);
284 id
= simple_strtoul(identifier
, &endptr
, 0);
286 pr_err("chap identifier: %lu greater than 255\n", id
);
290 * RFC 1994 says Identifier is no more than octet (8 bits).
292 pr_debug("[server] Got CHAP_I=%lu\n", id
);
296 if (extract_param(nr_in_ptr
, "CHAP_C", CHAP_CHALLENGE_STR_LEN
,
297 challenge
, &type
) < 0) {
298 pr_err("Could not find CHAP_C.\n");
303 pr_err("Could not find CHAP_C.\n");
306 pr_debug("[server] Got CHAP_C=%s\n", challenge
);
307 challenge_len
= chap_string_to_hex(challenge_binhex
, challenge
,
309 if (!challenge_len
) {
310 pr_err("Unable to convert incoming challenge\n");
314 * Generate CHAP_N and CHAP_R for mutual authentication.
316 tfm
= crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC
);
318 pr_err("Unable to allocate struct crypto_hash\n");
324 ret
= crypto_hash_init(&desc
);
326 pr_err("crypto_hash_init() failed\n");
327 crypto_free_hash(tfm
);
331 /* To handle both endiannesses */
333 sg_init_one(&sg
, &id_as_uchar
, 1);
334 ret
= crypto_hash_update(&desc
, &sg
, 1);
336 pr_err("crypto_hash_update() failed for id\n");
337 crypto_free_hash(tfm
);
341 sg_init_one(&sg
, auth
->password_mutual
,
342 strlen(auth
->password_mutual
));
343 ret
= crypto_hash_update(&desc
, &sg
, strlen(auth
->password_mutual
));
345 pr_err("crypto_hash_update() failed for"
346 " password_mutual\n");
347 crypto_free_hash(tfm
);
351 * Convert received challenge to binary hex.
353 sg_init_one(&sg
, challenge_binhex
, challenge_len
);
354 ret
= crypto_hash_update(&desc
, &sg
, challenge_len
);
356 pr_err("crypto_hash_update() failed for ma challenge\n");
357 crypto_free_hash(tfm
);
361 ret
= crypto_hash_final(&desc
, digest
);
363 pr_err("crypto_hash_final() failed for ma digest\n");
364 crypto_free_hash(tfm
);
367 crypto_free_hash(tfm
);
369 * Generate CHAP_N and CHAP_R.
371 *nr_out_len
= sprintf(nr_out_ptr
, "CHAP_N=%s", auth
->userid_mutual
);
373 pr_debug("[server] Sending CHAP_N=%s\n", auth
->userid_mutual
);
375 * Convert response from binary hex to ascii hext.
377 chap_binaryhex_to_asciihex(response
, digest
, MD5_SIGNATURE_SIZE
);
378 *nr_out_len
+= sprintf(nr_out_ptr
+ *nr_out_len
, "CHAP_R=0x%s",
381 pr_debug("[server] Sending CHAP_R=0x%s\n", response
);
385 kfree(challenge_binhex
);
389 static int chap_got_response(
390 struct iscsi_conn
*conn
,
391 struct iscsi_node_auth
*auth
,
394 unsigned int *nr_out_len
)
396 struct iscsi_chap
*chap
= conn
->auth_protocol
;
398 switch (chap
->digest_type
) {
399 case CHAP_DIGEST_MD5
:
400 if (chap_server_compute_md5(conn
, auth
, nr_in_ptr
,
401 nr_out_ptr
, nr_out_len
) < 0)
405 pr_err("Unknown CHAP digest type %d!\n",
412 struct iscsi_conn
*conn
,
413 struct iscsi_node_auth
*auth
,
419 struct iscsi_chap
*chap
= conn
->auth_protocol
;
422 chap
= chap_server_open(conn
, auth
, in_text
, out_text
, out_len
);
425 chap
->chap_state
= CHAP_STAGE_SERVER_AIC
;
427 } else if (chap
->chap_state
== CHAP_STAGE_SERVER_AIC
) {
428 convert_null_to_semi(in_text
, *in_len
);
429 if (chap_got_response(conn
, auth
, in_text
, out_text
,
434 if (auth
->authenticate_target
)
435 chap
->chap_state
= CHAP_STAGE_SERVER_NR
;
This page took 0.040609 seconds and 5 git commands to generate.