From nobody Sat Feb 7 06:45:05 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+76201+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+76201+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1623154396; cv=none; d=zohomail.com; s=zohoarc; b=UHA/CbRNKPUz9Dp/hRihfp5UZjnwo6+t2pAgIb+hx3tPBi/3cTEL+lMcDks8E8m6Bc8wvC7cvsg6iRvIH+cEbvce0mzYWASrh6MHe683+IVecnyPNRDbKxgb3u4NEI1ho4xJFIG/F09gIcs7DuPH4TdegxLtk9V41nLrXHYWB8I= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1623154396; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=Y7ZB++SHT7g6MrpzO4YNM416/+8q0uLgVJvFyEutf2k=; b=ba79t7dBUX2DKSAOynRoMLxAOgc/dXIg/cTgItqLyak/s5PGd/QN0ATdChPjKahqRbsv4FI4ucElESDP0G0iFMQwfGJFMmd5nxDOzD9UZUaQ1wJG4RnXK/40TiwDzRlXbjWqxht6Ck/OD8UFi+1/L/SOPK16U9amoUmJyo90rMA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+76201+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1623154396205952.8517070275157; Tue, 8 Jun 2021 05:13:16 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id V19XYY1788612x1h7eErsxOG; Tue, 08 Jun 2021 05:13:15 -0700 X-Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) by mx.groups.io with SMTP id smtpd.web09.11415.1623154390161129444 for ; Tue, 08 Jun 2021 05:13:10 -0700 X-Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-163-Gsib74uSOP-CMhlCPEj2ug-1; Tue, 08 Jun 2021 08:13:08 -0400 X-MC-Unique: Gsib74uSOP-CMhlCPEj2ug-1 X-Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id BF8C2107ACE3; Tue, 8 Jun 2021 12:13:06 +0000 (UTC) X-Received: from lacos-laptop-7.usersys.redhat.com (ovpn-113-27.ams2.redhat.com [10.36.113.27]) by smtp.corp.redhat.com (Postfix) with ESMTP id 87A26197F9; Tue, 8 Jun 2021 12:13:05 +0000 (UTC) From: "Laszlo Ersek" To: edk2-devel-groups-io Cc: Jiaxin Wu , Maciej Rabeda , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Siyuan Fu Subject: [edk2-devel] [PUBLIC edk2 PATCH v2 03/10] NetworkPkg/IScsiDxe: clean up "ISCSI_CHAP_AUTH_DATA.OutChallengeLength" Date: Tue, 8 Jun 2021 14:12:52 +0200 Message-Id: <20210608121259.32451-4-lersek@redhat.com> In-Reply-To: <20210608121259.32451-1-lersek@redhat.com> References: <20210608121259.32451-1-lersek@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,lersek@redhat.com X-Gm-Message-State: QGF8oRhdWgeWxhgaj6uHsQisx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1623154395; bh=Y7ZB++SHT7g6MrpzO4YNM416/+8q0uLgVJvFyEutf2k=; h=Cc:Content-Type:Date:From:Reply-To:Subject:To; b=gsAc29pbhKXKpjmHDxQAq+pYOK96yX9EHC38rkNKr/hRU9wPieEa+A92EdzQIbu8mF6 v9qn+/P5l8X0Enink5ADaT4lg0kaTg3gEX22QxYlJaIp9SRvlS1WDETI4dUSwVcEYjIpw gfRoP0phXhqav2Wlreud2k2fyAWKOb4aPmo= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Type: text/plain; charset="utf-8" The "ISCSI_CHAP_AUTH_DATA.OutChallenge" field is declared as a UINT8 array with ISCSI_CHAP_AUTH_MAX_LEN (1024) elements. However, when the challenge is generated and formatted, only ISCSI_CHAP_RSP_LEN (16) octets are used in the array. Change the array size to ISCSI_CHAP_RSP_LEN, and remove the (now unused) ISCSI_CHAP_AUTH_MAX_LEN macro. Remove the "ISCSI_CHAP_AUTH_DATA.OutChallengeLength" field, which is superfluous too. Most importantly, explain in a new comment *why* tying the challenge size to the digest size (ISCSI_CHAP_RSP_LEN) has always made sense. (See also Linux kernel commit 19f5f88ed779, "scsi: target: iscsi: tie the challenge length to the hash digest size", 2019-11-06.) For sure, the motivation that the new comment now explains has always been there, and has always been the same, for IScsiDxe; it's just that now we spell it out too. No change in peer-visible behavior. Cc: Jiaxin Wu Cc: Maciej Rabeda Cc: Philippe Mathieu-Daud=C3=A9 Cc: Siyuan Fu Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3356 Signed-off-by: Laszlo Ersek Reviewed-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Maciej Rabeda --- NetworkPkg/IScsiDxe/IScsiCHAP.h | 9 ++++++--- NetworkPkg/IScsiDxe/IScsiCHAP.c | 3 +-- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/NetworkPkg/IScsiDxe/IScsiCHAP.h b/NetworkPkg/IScsiDxe/IScsiCHA= P.h index 1fc1d96ea3f3..35d5d6ec29e3 100644 --- a/NetworkPkg/IScsiDxe/IScsiCHAP.h +++ b/NetworkPkg/IScsiDxe/IScsiCHAP.h @@ -3,39 +3,38 @@ =20 Copyright (c) 2004 - 2018, Intel Corporation. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent =20 **/ =20 #ifndef _ISCSI_CHAP_H_ #define _ISCSI_CHAP_H_ =20 #define ISCSI_AUTH_METHOD_CHAP "CHAP" =20 #define ISCSI_KEY_CHAP_ALGORITHM "CHAP_A" #define ISCSI_KEY_CHAP_IDENTIFIER "CHAP_I" #define ISCSI_KEY_CHAP_CHALLENGE "CHAP_C" #define ISCSI_KEY_CHAP_NAME "CHAP_N" #define ISCSI_KEY_CHAP_RESPONSE "CHAP_R" =20 #define ISCSI_CHAP_ALGORITHM_MD5 5 =20 -#define ISCSI_CHAP_AUTH_MAX_LEN 1024 /// /// MD5_HASHSIZE /// #define ISCSI_CHAP_RSP_LEN 16 =20 #define ISCSI_CHAP_STEP_ONE 1 #define ISCSI_CHAP_STEP_TWO 2 #define ISCSI_CHAP_STEP_THREE 3 #define ISCSI_CHAP_STEP_FOUR 4 =20 =20 #pragma pack(1) =20 typedef struct _ISCSI_CHAP_AUTH_CONFIG_NVDATA { UINT8 CHAPType; CHAR8 CHAPName[ISCSI_CHAP_NAME_STORAGE]; CHAR8 CHAPSecret[ISCSI_CHAP_SECRET_STORAGE]; CHAR8 ReverseCHAPName[ISCSI_CHAP_NAME_STORAGE]; CHAR8 ReverseCHAPSecret[ISCSI_CHAP_SECRET_STORAGE]; @@ -43,41 +42,45 @@ typedef struct _ISCSI_CHAP_AUTH_CONFIG_NVDATA { =20 #pragma pack() =20 /// /// ISCSI CHAP Authentication Data /// typedef struct _ISCSI_CHAP_AUTH_DATA { ISCSI_CHAP_AUTH_CONFIG_NVDATA *AuthConfig; UINT32 InIdentifier; UINT8 InChallenge[1024]; UINT32 InChallengeLength; // // Calculated CHAP Response (CHAP_R) value. // UINT8 CHAPResponse[ISCSI_CHAP_RSP_LEN]; =20 // // Auth-data to be sent out for mutual authentication. // + // While the challenge size is technically independent of the hashing + // algorithm, it is good practice to avoid hashing *fewer bytes* than the + // digest size. In other words, it's good practice to feed *at least as = many + // bytes* to the hashing algorithm as the hashing algorithm will output. + // UINT32 OutIdentifier; - UINT8 OutChallenge[ISCSI_CHAP_AUTH_MAX_LEN]; - UINT32 OutChallengeLength; + UINT8 OutChallenge[ISCSI_CHAP_RSP_LEN]; } ISCSI_CHAP_AUTH_DATA; =20 /** This function checks the received iSCSI Login Response during the securi= ty negotiation stage. =20 @param[in] Conn The iSCSI connection. =20 @retval EFI_SUCCESS The Login Response passed the CHAP validati= on. @retval EFI_OUT_OF_RESOURCES Failed to allocate memory. @retval EFI_PROTOCOL_ERROR Some kind of protocol error occurred. @retval Others Other errors as indicated. =20 **/ EFI_STATUS IScsiCHAPOnRspReceived ( IN ISCSI_CONNECTION *Conn ); /** diff --git a/NetworkPkg/IScsiDxe/IScsiCHAP.c b/NetworkPkg/IScsiDxe/IScsiCHA= P.c index df3c2eb1200a..9e192ce292e8 100644 --- a/NetworkPkg/IScsiDxe/IScsiCHAP.c +++ b/NetworkPkg/IScsiDxe/IScsiCHAP.c @@ -106,39 +106,39 @@ IScsiCHAPCalculateResponse ( **/ EFI_STATUS IScsiCHAPAuthTarget ( IN ISCSI_CHAP_AUTH_DATA *AuthData, IN UINT8 *TargetResponse ) { EFI_STATUS Status; UINT32 SecretSize; UINT8 VerifyRsp[ISCSI_CHAP_RSP_LEN]; =20 Status =3D EFI_SUCCESS; =20 SecretSize =3D (UINT32) AsciiStrLen (AuthData->AuthConfig->ReverseCHAPS= ecret); Status =3D IScsiCHAPCalculateResponse ( AuthData->OutIdentifier, AuthData->AuthConfig->ReverseCHAPSecret, SecretSize, AuthData->OutChallenge, - AuthData->OutChallengeLength, + ISCSI_CHAP_RSP_LEN, // ChallengeLength VerifyRsp ); =20 if (CompareMem (VerifyRsp, TargetResponse, ISCSI_CHAP_RSP_LEN) !=3D 0) { Status =3D EFI_SECURITY_VIOLATION; } =20 return Status; } =20 =20 /** This function checks the received iSCSI Login Response during the securi= ty negotiation stage. =20 @param[in] Conn The iSCSI connection. =20 @retval EFI_SUCCESS The Login Response passed the CHAP validati= on. @retval EFI_OUT_OF_RESOURCES Failed to allocate memory. @@ -474,39 +474,38 @@ IScsiCHAPToSendReq ( IScsiBinToHex ( (UINT8 *) AuthData->CHAPResponse, ISCSI_CHAP_RSP_LEN, Response, &RspLen ); IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_RESPONSE, Response); =20 if (AuthData->AuthConfig->CHAPType =3D=3D ISCSI_CHAP_MUTUAL) { // // CHAP_I=3D // IScsiGenRandom ((UINT8 *) &AuthData->OutIdentifier, 1); AsciiSPrint (ValueStr, sizeof (ValueStr), "%d", AuthData->OutIdentif= ier); IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_IDENTIFIER, ValueStr); // // CHAP_C=3D // IScsiGenRandom ((UINT8 *) AuthData->OutChallenge, ISCSI_CHAP_RSP_LEN= ); - AuthData->OutChallengeLength =3D ISCSI_CHAP_RSP_LEN; IScsiBinToHex ( (UINT8 *) AuthData->OutChallenge, ISCSI_CHAP_RSP_LEN, Challenge, &ChallengeLen ); IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_CHALLENGE, Challenge); =20 Conn->AuthStep =3D ISCSI_CHAP_STEP_FOUR; } // // Set the stage transition flag. // ISCSI_SET_FLAG (LoginReq, ISCSI_LOGIN_REQ_PDU_FLAG_TRANSIT); break; =20 default: Status =3D EFI_PROTOCOL_ERROR; break; --=20 2.19.1.3.g30247aa5d201 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#76201): https://edk2.groups.io/g/devel/message/76201 Mute This Topic: https://groups.io/mt/83394109/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-