lkml.org 
[lkml]   [2014]   [Jul]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.2 062/125] iscsi-target: Reject mutual authentication with reflected CHAP_C
    3.2.61-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Nicholas Bellinger <nab@linux-iscsi.org>

    commit 1d2b60a5545942b1376cb48c1d55843d71e3a08f upstream.

    This patch adds an explicit check in chap_server_compute_md5() to ensure
    the CHAP_C value received from the initiator during mutual authentication
    does not match the original CHAP_C provided by the target.

    This is in line with RFC-3720, section 8.2.1:

    Originators MUST NOT reuse the CHAP challenge sent by the Responder
    for the other direction of a bidirectional authentication.
    Responders MUST check for this condition and close the iSCSI TCP
    connection if it occurs.

    Reported-by: Tejas Vaykole <tejas.vaykole@calsoftinc.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/target/iscsi/iscsi_target_auth.c | 10 ++++++++++
    1 file changed, 10 insertions(+)

    --- a/drivers/target/iscsi/iscsi_target_auth.c
    +++ b/drivers/target/iscsi/iscsi_target_auth.c
    @@ -337,6 +337,16 @@ static int chap_server_compute_md5(
    goto out;
    }
    /*
    + * During mutual authentication, the CHAP_C generated by the
    + * initiator must not match the original CHAP_C generated by
    + * the target.
    + */
    + if (!memcmp(challenge_binhex, chap->challenge, CHAP_CHALLENGE_LENGTH)) {
    + pr_err("initiator CHAP_C matches target CHAP_C, failing"
    + " login attempt\n");
    + goto out;
    + }
    + /*
    * Generate CHAP_N and CHAP_R for mutual authentication.
    */
    tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC);


    \
     
     \ /
      Last update: 2014-07-08 22:42    [W:4.156 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site