1 /*******************************************************************************
2 * This file houses the main functions for the iSCSI CHAP support
4 * \u00a9 Copyright 2007-2011 RisingTide Systems LLC.
6 * Licensed to the Linux Foundation under the General Public License (GPL) version 2.
8 * Author: Nicholas A. Bellinger <nab@linux-iscsi.org>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 ******************************************************************************/
21 #include <linux/kernel.h>
22 #include <linux/string.h>
23 #include <linux/crypto.h>
24 #include <linux/err.h>
25 #include <linux/scatterlist.h>
27 #include "iscsi_target_core.h"
28 #include "iscsi_target_nego.h"
29 #include "iscsi_target_auth.h"
31 static int chap_string_to_hex(unsigned char *dst
, unsigned char *src
, int len
)
33 int j
= DIV_ROUND_UP(len
, 2), rc
;
35 rc
= hex2bin(dst
, src
, j
);
37 pr_debug("CHAP string contains non hex digit symbols\n");
43 static void chap_binaryhex_to_asciihex(char *dst
, char *src
, int src_len
)
47 for (i
= 0; i
< src_len
; i
++) {
48 sprintf(&dst
[i
*2], "%02x", (int) src
[i
] & 0xff);
52 static void chap_gen_challenge(
53 struct iscsi_conn
*conn
,
58 unsigned char challenge_asciihex
[CHAP_CHALLENGE_LENGTH
* 2 + 1];
59 struct iscsi_chap
*chap
= conn
->auth_protocol
;
61 memset(challenge_asciihex
, 0, CHAP_CHALLENGE_LENGTH
* 2 + 1);
63 get_random_bytes(chap
->challenge
, CHAP_CHALLENGE_LENGTH
);
64 chap_binaryhex_to_asciihex(challenge_asciihex
, chap
->challenge
,
65 CHAP_CHALLENGE_LENGTH
);
67 * Set CHAP_C, and copy the generated challenge into c_str.
69 *c_len
+= sprintf(c_str
+ *c_len
, "CHAP_C=0x%s", challenge_asciihex
);
72 pr_debug("[%s] Sending CHAP_C=0x%s\n\n", (caller
) ? "server" : "client",
77 static struct iscsi_chap
*chap_server_open(
78 struct iscsi_conn
*conn
,
79 struct iscsi_node_auth
*auth
,
82 unsigned int *aic_len
)
84 struct iscsi_chap
*chap
;
86 if (!(auth
->naf_flags
& NAF_USERID_SET
) ||
87 !(auth
->naf_flags
& NAF_PASSWORD_SET
)) {
88 pr_err("CHAP user or password not set for"
93 conn
->auth_protocol
= kzalloc(sizeof(struct iscsi_chap
), GFP_KERNEL
);
94 if (!conn
->auth_protocol
)
97 chap
= conn
->auth_protocol
;
99 * We only support MD5 MDA presently.
101 if (strncmp(a_str
, "CHAP_A=5", 8)) {
102 pr_err("CHAP_A is not MD5.\n");
105 pr_debug("[server] Got CHAP_A=5\n");
107 * Send back CHAP_A set to MD5.
109 *aic_len
= sprintf(aic_str
, "CHAP_A=5");
111 chap
->digest_type
= CHAP_DIGEST_MD5
;
112 pr_debug("[server] Sending CHAP_A=%d\n", chap
->digest_type
);
116 chap
->id
= ISCSI_TPG_C(conn
)->tpg_chap_id
++;
117 *aic_len
+= sprintf(aic_str
+ *aic_len
, "CHAP_I=%d", chap
->id
);
119 pr_debug("[server] Sending CHAP_I=%d\n", chap
->id
);
121 * Generate Challenge.
123 chap_gen_challenge(conn
, 1, aic_str
, aic_len
);
128 static void chap_close(struct iscsi_conn
*conn
)
130 kfree(conn
->auth_protocol
);
131 conn
->auth_protocol
= NULL
;
134 static int chap_server_compute_md5(
135 struct iscsi_conn
*conn
,
136 struct iscsi_node_auth
*auth
,
139 unsigned int *nr_out_len
)
143 unsigned char id_as_uchar
;
144 unsigned char digest
[MD5_SIGNATURE_SIZE
];
145 unsigned char type
, response
[MD5_SIGNATURE_SIZE
* 2 + 2];
146 unsigned char identifier
[10], *challenge
= NULL
;
147 unsigned char *challenge_binhex
= NULL
;
148 unsigned char client_digest
[MD5_SIGNATURE_SIZE
];
149 unsigned char server_digest
[MD5_SIGNATURE_SIZE
];
150 unsigned char chap_n
[MAX_CHAP_N_SIZE
], chap_r
[MAX_RESPONSE_LENGTH
];
151 struct iscsi_chap
*chap
= conn
->auth_protocol
;
152 struct crypto_hash
*tfm
;
153 struct hash_desc desc
;
154 struct scatterlist sg
;
155 int auth_ret
= -1, ret
, challenge_len
;
157 memset(identifier
, 0, 10);
158 memset(chap_n
, 0, MAX_CHAP_N_SIZE
);
159 memset(chap_r
, 0, MAX_RESPONSE_LENGTH
);
160 memset(digest
, 0, MD5_SIGNATURE_SIZE
);
161 memset(response
, 0, MD5_SIGNATURE_SIZE
* 2 + 2);
162 memset(client_digest
, 0, MD5_SIGNATURE_SIZE
);
163 memset(server_digest
, 0, MD5_SIGNATURE_SIZE
);
165 challenge
= kzalloc(CHAP_CHALLENGE_STR_LEN
, GFP_KERNEL
);
167 pr_err("Unable to allocate challenge buffer\n");
171 challenge_binhex
= kzalloc(CHAP_CHALLENGE_STR_LEN
, GFP_KERNEL
);
172 if (!challenge_binhex
) {
173 pr_err("Unable to allocate challenge_binhex buffer\n");
179 if (extract_param(nr_in_ptr
, "CHAP_N", MAX_CHAP_N_SIZE
, chap_n
,
181 pr_err("Could not find CHAP_N.\n");
185 pr_err("Could not find CHAP_N.\n");
189 if (memcmp(chap_n
, auth
->userid
, strlen(auth
->userid
)) != 0) {
190 pr_err("CHAP_N values do not match!\n");
193 pr_debug("[server] Got CHAP_N=%s\n", chap_n
);
197 if (extract_param(nr_in_ptr
, "CHAP_R", MAX_RESPONSE_LENGTH
, chap_r
,
199 pr_err("Could not find CHAP_R.\n");
203 pr_err("Could not find CHAP_R.\n");
207 pr_debug("[server] Got CHAP_R=%s\n", chap_r
);
208 chap_string_to_hex(client_digest
, chap_r
, strlen(chap_r
));
210 tfm
= crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC
);
212 pr_err("Unable to allocate struct crypto_hash\n");
218 ret
= crypto_hash_init(&desc
);
220 pr_err("crypto_hash_init() failed\n");
221 crypto_free_hash(tfm
);
225 sg_init_one(&sg
, &chap
->id
, 1);
226 ret
= crypto_hash_update(&desc
, &sg
, 1);
228 pr_err("crypto_hash_update() failed for id\n");
229 crypto_free_hash(tfm
);
233 sg_init_one(&sg
, &auth
->password
, strlen(auth
->password
));
234 ret
= crypto_hash_update(&desc
, &sg
, strlen(auth
->password
));
236 pr_err("crypto_hash_update() failed for password\n");
237 crypto_free_hash(tfm
);
241 sg_init_one(&sg
, chap
->challenge
, CHAP_CHALLENGE_LENGTH
);
242 ret
= crypto_hash_update(&desc
, &sg
, CHAP_CHALLENGE_LENGTH
);
244 pr_err("crypto_hash_update() failed for challenge\n");
245 crypto_free_hash(tfm
);
249 ret
= crypto_hash_final(&desc
, server_digest
);
251 pr_err("crypto_hash_final() failed for server digest\n");
252 crypto_free_hash(tfm
);
255 crypto_free_hash(tfm
);
257 chap_binaryhex_to_asciihex(response
, server_digest
, MD5_SIGNATURE_SIZE
);
258 pr_debug("[server] MD5 Server Digest: %s\n", response
);
260 if (memcmp(server_digest
, client_digest
, MD5_SIGNATURE_SIZE
) != 0) {
261 pr_debug("[server] MD5 Digests do not match!\n\n");
264 pr_debug("[server] MD5 Digests match, CHAP connetication"
267 * One way authentication has succeeded, return now if mutual
268 * authentication is not enabled.
270 if (!auth
->authenticate_target
) {
272 kfree(challenge_binhex
);
278 if (extract_param(nr_in_ptr
, "CHAP_I", 10, identifier
, &type
) < 0) {
279 pr_err("Could not find CHAP_I.\n");
284 id
= simple_strtoul(&identifier
[2], &endptr
, 0);
286 id
= simple_strtoul(identifier
, &endptr
, 0);
288 pr_err("chap identifier: %lu greater than 255\n", id
);
292 * RFC 1994 says Identifier is no more than octet (8 bits).
294 pr_debug("[server] Got CHAP_I=%lu\n", id
);
298 if (extract_param(nr_in_ptr
, "CHAP_C", CHAP_CHALLENGE_STR_LEN
,
299 challenge
, &type
) < 0) {
300 pr_err("Could not find CHAP_C.\n");
305 pr_err("Could not find CHAP_C.\n");
308 pr_debug("[server] Got CHAP_C=%s\n", challenge
);
309 challenge_len
= chap_string_to_hex(challenge_binhex
, challenge
,
311 if (!challenge_len
) {
312 pr_err("Unable to convert incoming challenge\n");
316 * Generate CHAP_N and CHAP_R for mutual authentication.
318 tfm
= crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC
);
320 pr_err("Unable to allocate struct crypto_hash\n");
326 ret
= crypto_hash_init(&desc
);
328 pr_err("crypto_hash_init() failed\n");
329 crypto_free_hash(tfm
);
333 /* To handle both endiannesses */
335 sg_init_one(&sg
, &id_as_uchar
, 1);
336 ret
= crypto_hash_update(&desc
, &sg
, 1);
338 pr_err("crypto_hash_update() failed for id\n");
339 crypto_free_hash(tfm
);
343 sg_init_one(&sg
, auth
->password_mutual
,
344 strlen(auth
->password_mutual
));
345 ret
= crypto_hash_update(&desc
, &sg
, strlen(auth
->password_mutual
));
347 pr_err("crypto_hash_update() failed for"
348 " password_mutual\n");
349 crypto_free_hash(tfm
);
353 * Convert received challenge to binary hex.
355 sg_init_one(&sg
, challenge_binhex
, challenge_len
);
356 ret
= crypto_hash_update(&desc
, &sg
, challenge_len
);
358 pr_err("crypto_hash_update() failed for ma challenge\n");
359 crypto_free_hash(tfm
);
363 ret
= crypto_hash_final(&desc
, digest
);
365 pr_err("crypto_hash_final() failed for ma digest\n");
366 crypto_free_hash(tfm
);
369 crypto_free_hash(tfm
);
371 * Generate CHAP_N and CHAP_R.
373 *nr_out_len
= sprintf(nr_out_ptr
, "CHAP_N=%s", auth
->userid_mutual
);
375 pr_debug("[server] Sending CHAP_N=%s\n", auth
->userid_mutual
);
377 * Convert response from binary hex to ascii hext.
379 chap_binaryhex_to_asciihex(response
, digest
, MD5_SIGNATURE_SIZE
);
380 *nr_out_len
+= sprintf(nr_out_ptr
+ *nr_out_len
, "CHAP_R=0x%s",
383 pr_debug("[server] Sending CHAP_R=0x%s\n", response
);
387 kfree(challenge_binhex
);
391 static int chap_got_response(
392 struct iscsi_conn
*conn
,
393 struct iscsi_node_auth
*auth
,
396 unsigned int *nr_out_len
)
398 struct iscsi_chap
*chap
= conn
->auth_protocol
;
400 switch (chap
->digest_type
) {
401 case CHAP_DIGEST_MD5
:
402 if (chap_server_compute_md5(conn
, auth
, nr_in_ptr
,
403 nr_out_ptr
, nr_out_len
) < 0)
407 pr_err("Unknown CHAP digest type %d!\n",
414 struct iscsi_conn
*conn
,
415 struct iscsi_node_auth
*auth
,
421 struct iscsi_chap
*chap
= conn
->auth_protocol
;
424 chap
= chap_server_open(conn
, auth
, in_text
, out_text
, out_len
);
427 chap
->chap_state
= CHAP_STAGE_SERVER_AIC
;
429 } else if (chap
->chap_state
== CHAP_STAGE_SERVER_AIC
) {
430 convert_null_to_semi(in_text
, *in_len
);
431 if (chap_got_response(conn
, auth
, in_text
, out_text
,
436 if (auth
->authenticate_target
)
437 chap
->chap_state
= CHAP_STAGE_SERVER_NR
;