| 1 | /** @file
|
|---|
| 2 | This file is for Challenge-Handshake Authentication Protocol (CHAP) Configuration.
|
|---|
| 3 |
|
|---|
| 4 | Copyright (c) 2004 - 2018, Intel Corporation. All rights reserved.<BR>
|
|---|
| 5 | SPDX-License-Identifier: BSD-2-Clause-Patent
|
|---|
| 6 |
|
|---|
| 7 | **/
|
|---|
| 8 |
|
|---|
| 9 | #include "IScsiImpl.h"
|
|---|
| 10 |
|
|---|
| 11 | /**
|
|---|
| 12 | Initator calculates its own expected hash value.
|
|---|
| 13 |
|
|---|
| 14 | @param[in] ChapIdentifier iSCSI CHAP identifier sent by authenticator.
|
|---|
| 15 | @param[in] ChapSecret iSCSI CHAP secret of the authenticator.
|
|---|
| 16 | @param[in] SecretLength The length of iSCSI CHAP secret.
|
|---|
| 17 | @param[in] ChapChallenge The challenge message sent by authenticator.
|
|---|
| 18 | @param[in] ChallengeLength The length of iSCSI CHAP challenge message.
|
|---|
| 19 | @param[out] ChapResponse The calculation of the expected hash value.
|
|---|
| 20 |
|
|---|
| 21 | @retval EFI_SUCCESS The expected hash value was calculatedly successfully.
|
|---|
| 22 | @retval EFI_PROTOCOL_ERROR The length of the secret should be at least the
|
|---|
| 23 | length of the hash value for the hashing algorithm chosen.
|
|---|
| 24 | @retval EFI_PROTOCOL_ERROR MD5 hash operation fail.
|
|---|
| 25 | @retval EFI_OUT_OF_RESOURCES Fail to allocate resource to complete MD5.
|
|---|
| 26 |
|
|---|
| 27 | **/
|
|---|
| 28 | EFI_STATUS
|
|---|
| 29 | IScsiCHAPCalculateResponse (
|
|---|
| 30 | IN UINT32 ChapIdentifier,
|
|---|
| 31 | IN CHAR8 *ChapSecret,
|
|---|
| 32 | IN UINT32 SecretLength,
|
|---|
| 33 | IN UINT8 *ChapChallenge,
|
|---|
| 34 | IN UINT32 ChallengeLength,
|
|---|
| 35 | OUT UINT8 *ChapResponse
|
|---|
| 36 | )
|
|---|
| 37 | {
|
|---|
| 38 | UINTN Md5ContextSize;
|
|---|
| 39 | VOID *Md5Ctx;
|
|---|
| 40 | CHAR8 IdByte[1];
|
|---|
| 41 | EFI_STATUS Status;
|
|---|
| 42 |
|
|---|
| 43 | if (SecretLength < ISCSI_CHAP_SECRET_MIN_LEN) {
|
|---|
| 44 | return EFI_PROTOCOL_ERROR;
|
|---|
| 45 | }
|
|---|
| 46 |
|
|---|
| 47 | Md5ContextSize = Md5GetContextSize ();
|
|---|
| 48 | Md5Ctx = AllocatePool (Md5ContextSize);
|
|---|
| 49 | if (Md5Ctx == NULL) {
|
|---|
| 50 | return EFI_OUT_OF_RESOURCES;
|
|---|
| 51 | }
|
|---|
| 52 |
|
|---|
| 53 | Status = EFI_PROTOCOL_ERROR;
|
|---|
| 54 |
|
|---|
| 55 | if (!Md5Init (Md5Ctx)) {
|
|---|
| 56 | goto Exit;
|
|---|
| 57 | }
|
|---|
| 58 |
|
|---|
| 59 | //
|
|---|
| 60 | // Hash Identifier - Only calculate 1 byte data (RFC1994)
|
|---|
| 61 | //
|
|---|
| 62 | IdByte[0] = (CHAR8) ChapIdentifier;
|
|---|
| 63 | if (!Md5Update (Md5Ctx, IdByte, 1)) {
|
|---|
| 64 | goto Exit;
|
|---|
| 65 | }
|
|---|
| 66 |
|
|---|
| 67 | //
|
|---|
| 68 | // Hash Secret
|
|---|
| 69 | //
|
|---|
| 70 | if (!Md5Update (Md5Ctx, ChapSecret, SecretLength)) {
|
|---|
| 71 | goto Exit;
|
|---|
| 72 | }
|
|---|
| 73 |
|
|---|
| 74 | //
|
|---|
| 75 | // Hash Challenge received from Target
|
|---|
| 76 | //
|
|---|
| 77 | if (!Md5Update (Md5Ctx, ChapChallenge, ChallengeLength)) {
|
|---|
| 78 | goto Exit;
|
|---|
| 79 | }
|
|---|
| 80 |
|
|---|
| 81 | if (Md5Final (Md5Ctx, ChapResponse)) {
|
|---|
| 82 | Status = EFI_SUCCESS;
|
|---|
| 83 | }
|
|---|
| 84 |
|
|---|
| 85 | Exit:
|
|---|
| 86 | FreePool (Md5Ctx);
|
|---|
| 87 | return Status;
|
|---|
| 88 | }
|
|---|
| 89 |
|
|---|
| 90 | /**
|
|---|
| 91 | The initator checks the CHAP response replied by target against its own
|
|---|
| 92 | calculation of the expected hash value.
|
|---|
| 93 |
|
|---|
| 94 | @param[in] AuthData iSCSI CHAP authentication data.
|
|---|
| 95 | @param[in] TargetResponse The response from target.
|
|---|
| 96 |
|
|---|
| 97 | @retval EFI_SUCCESS The response from target passed authentication.
|
|---|
| 98 | @retval EFI_SECURITY_VIOLATION The response from target was not expected value.
|
|---|
| 99 | @retval Others Other errors as indicated.
|
|---|
| 100 |
|
|---|
| 101 | **/
|
|---|
| 102 | EFI_STATUS
|
|---|
| 103 | IScsiCHAPAuthTarget (
|
|---|
| 104 | IN ISCSI_CHAP_AUTH_DATA *AuthData,
|
|---|
| 105 | IN UINT8 *TargetResponse
|
|---|
| 106 | )
|
|---|
| 107 | {
|
|---|
| 108 | EFI_STATUS Status;
|
|---|
| 109 | UINT32 SecretSize;
|
|---|
| 110 | UINT8 VerifyRsp[ISCSI_CHAP_RSP_LEN];
|
|---|
| 111 |
|
|---|
| 112 | Status = EFI_SUCCESS;
|
|---|
| 113 |
|
|---|
| 114 | SecretSize = (UINT32) AsciiStrLen (AuthData->AuthConfig->ReverseCHAPSecret);
|
|---|
| 115 | Status = IScsiCHAPCalculateResponse (
|
|---|
| 116 | AuthData->OutIdentifier,
|
|---|
| 117 | AuthData->AuthConfig->ReverseCHAPSecret,
|
|---|
| 118 | SecretSize,
|
|---|
| 119 | AuthData->OutChallenge,
|
|---|
| 120 | AuthData->OutChallengeLength,
|
|---|
| 121 | VerifyRsp
|
|---|
| 122 | );
|
|---|
| 123 |
|
|---|
| 124 | if (CompareMem (VerifyRsp, TargetResponse, ISCSI_CHAP_RSP_LEN) != 0) {
|
|---|
| 125 | Status = EFI_SECURITY_VIOLATION;
|
|---|
| 126 | }
|
|---|
| 127 |
|
|---|
| 128 | return Status;
|
|---|
| 129 | }
|
|---|
| 130 |
|
|---|
| 131 |
|
|---|
| 132 | /**
|
|---|
| 133 | This function checks the received iSCSI Login Response during the security
|
|---|
| 134 | negotiation stage.
|
|---|
| 135 |
|
|---|
| 136 | @param[in] Conn The iSCSI connection.
|
|---|
| 137 |
|
|---|
| 138 | @retval EFI_SUCCESS The Login Response passed the CHAP validation.
|
|---|
| 139 | @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
|
|---|
| 140 | @retval EFI_PROTOCOL_ERROR Some kind of protocol error occurred.
|
|---|
| 141 | @retval Others Other errors as indicated.
|
|---|
| 142 |
|
|---|
| 143 | **/
|
|---|
| 144 | EFI_STATUS
|
|---|
| 145 | IScsiCHAPOnRspReceived (
|
|---|
| 146 | IN ISCSI_CONNECTION *Conn
|
|---|
| 147 | )
|
|---|
| 148 | {
|
|---|
| 149 | EFI_STATUS Status;
|
|---|
| 150 | ISCSI_SESSION *Session;
|
|---|
| 151 | ISCSI_CHAP_AUTH_DATA *AuthData;
|
|---|
| 152 | CHAR8 *Value;
|
|---|
| 153 | UINT8 *Data;
|
|---|
| 154 | UINT32 Len;
|
|---|
| 155 | LIST_ENTRY *KeyValueList;
|
|---|
| 156 | UINTN Algorithm;
|
|---|
| 157 | CHAR8 *Identifier;
|
|---|
| 158 | CHAR8 *Challenge;
|
|---|
| 159 | CHAR8 *Name;
|
|---|
| 160 | CHAR8 *Response;
|
|---|
| 161 | UINT8 TargetRsp[ISCSI_CHAP_RSP_LEN];
|
|---|
| 162 | UINT32 RspLen;
|
|---|
| 163 | UINTN Result;
|
|---|
| 164 |
|
|---|
| 165 | ASSERT (Conn->CurrentStage == ISCSI_SECURITY_NEGOTIATION);
|
|---|
| 166 | ASSERT (Conn->RspQue.BufNum != 0);
|
|---|
| 167 |
|
|---|
| 168 | Session = Conn->Session;
|
|---|
| 169 | AuthData = &Session->AuthData.CHAP;
|
|---|
| 170 | Len = Conn->RspQue.BufSize;
|
|---|
| 171 | Data = AllocateZeroPool (Len);
|
|---|
| 172 | if (Data == NULL) {
|
|---|
| 173 | return EFI_OUT_OF_RESOURCES;
|
|---|
| 174 | }
|
|---|
| 175 | //
|
|---|
| 176 | // Copy the data in case the data spans over multiple PDUs.
|
|---|
| 177 | //
|
|---|
| 178 | NetbufQueCopy (&Conn->RspQue, 0, Len, Data);
|
|---|
| 179 |
|
|---|
| 180 | //
|
|---|
| 181 | // Build the key-value list from the data segment of the Login Response.
|
|---|
| 182 | //
|
|---|
| 183 | KeyValueList = IScsiBuildKeyValueList ((CHAR8 *) Data, Len);
|
|---|
| 184 | if (KeyValueList == NULL) {
|
|---|
| 185 | Status = EFI_OUT_OF_RESOURCES;
|
|---|
| 186 | goto ON_EXIT;
|
|---|
| 187 | }
|
|---|
| 188 |
|
|---|
| 189 | Status = EFI_PROTOCOL_ERROR;
|
|---|
| 190 |
|
|---|
| 191 | switch (Conn->AuthStep) {
|
|---|
| 192 | case ISCSI_AUTH_INITIAL:
|
|---|
| 193 | //
|
|---|
| 194 | // The first Login Response.
|
|---|
| 195 | //
|
|---|
| 196 | Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_TARGET_PORTAL_GROUP_TAG);
|
|---|
| 197 | if (Value == NULL) {
|
|---|
| 198 | goto ON_EXIT;
|
|---|
| 199 | }
|
|---|
| 200 |
|
|---|
| 201 | Result = IScsiNetNtoi (Value);
|
|---|
| 202 | if (Result > 0xFFFF) {
|
|---|
| 203 | goto ON_EXIT;
|
|---|
| 204 | }
|
|---|
| 205 |
|
|---|
| 206 | Session->TargetPortalGroupTag = (UINT16) Result;
|
|---|
| 207 |
|
|---|
| 208 | Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_AUTH_METHOD);
|
|---|
| 209 | if (Value == NULL) {
|
|---|
| 210 | goto ON_EXIT;
|
|---|
| 211 | }
|
|---|
| 212 | //
|
|---|
| 213 | // Initiator mandates CHAP authentication but target replies without "CHAP", or
|
|---|
| 214 | // initiator suggets "None" but target replies with some kind of auth method.
|
|---|
| 215 | //
|
|---|
| 216 | if (Session->AuthType == ISCSI_AUTH_TYPE_NONE) {
|
|---|
| 217 | if (AsciiStrCmp (Value, ISCSI_KEY_VALUE_NONE) != 0) {
|
|---|
| 218 | goto ON_EXIT;
|
|---|
| 219 | }
|
|---|
| 220 | } else if (Session->AuthType == ISCSI_AUTH_TYPE_CHAP) {
|
|---|
| 221 | if (AsciiStrCmp (Value, ISCSI_AUTH_METHOD_CHAP) != 0) {
|
|---|
| 222 | goto ON_EXIT;
|
|---|
| 223 | }
|
|---|
| 224 | } else {
|
|---|
| 225 | goto ON_EXIT;
|
|---|
| 226 | }
|
|---|
| 227 |
|
|---|
| 228 | //
|
|---|
| 229 | // Transit to CHAP step one.
|
|---|
| 230 | //
|
|---|
| 231 | Conn->AuthStep = ISCSI_CHAP_STEP_ONE;
|
|---|
| 232 | Status = EFI_SUCCESS;
|
|---|
| 233 | break;
|
|---|
| 234 |
|
|---|
| 235 | case ISCSI_CHAP_STEP_TWO:
|
|---|
| 236 | //
|
|---|
| 237 | // The Target replies with CHAP_A=<A> CHAP_I=<I> CHAP_C=<C>
|
|---|
| 238 | //
|
|---|
| 239 | Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_ALGORITHM);
|
|---|
| 240 | if (Value == NULL) {
|
|---|
| 241 | goto ON_EXIT;
|
|---|
| 242 | }
|
|---|
| 243 |
|
|---|
| 244 | Algorithm = IScsiNetNtoi (Value);
|
|---|
| 245 | if (Algorithm != ISCSI_CHAP_ALGORITHM_MD5) {
|
|---|
| 246 | //
|
|---|
| 247 | // Unsupported algorithm is chosen by target.
|
|---|
| 248 | //
|
|---|
| 249 | goto ON_EXIT;
|
|---|
| 250 | }
|
|---|
| 251 |
|
|---|
| 252 | Identifier = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_IDENTIFIER);
|
|---|
| 253 | if (Identifier == NULL) {
|
|---|
| 254 | goto ON_EXIT;
|
|---|
| 255 | }
|
|---|
| 256 |
|
|---|
| 257 | Challenge = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_CHALLENGE);
|
|---|
| 258 | if (Challenge == NULL) {
|
|---|
| 259 | goto ON_EXIT;
|
|---|
| 260 | }
|
|---|
| 261 | //
|
|---|
| 262 | // Process the CHAP identifier and CHAP Challenge from Target.
|
|---|
| 263 | // Calculate Response value.
|
|---|
| 264 | //
|
|---|
| 265 | Result = IScsiNetNtoi (Identifier);
|
|---|
| 266 | if (Result > 0xFF) {
|
|---|
| 267 | goto ON_EXIT;
|
|---|
| 268 | }
|
|---|
| 269 |
|
|---|
| 270 | AuthData->InIdentifier = (UINT32) Result;
|
|---|
| 271 | AuthData->InChallengeLength = ISCSI_CHAP_AUTH_MAX_LEN;
|
|---|
| 272 | IScsiHexToBin ((UINT8 *) AuthData->InChallenge, &AuthData->InChallengeLength, Challenge);
|
|---|
| 273 | Status = IScsiCHAPCalculateResponse (
|
|---|
| 274 | AuthData->InIdentifier,
|
|---|
| 275 | AuthData->AuthConfig->CHAPSecret,
|
|---|
| 276 | (UINT32) AsciiStrLen (AuthData->AuthConfig->CHAPSecret),
|
|---|
| 277 | AuthData->InChallenge,
|
|---|
| 278 | AuthData->InChallengeLength,
|
|---|
| 279 | AuthData->CHAPResponse
|
|---|
| 280 | );
|
|---|
| 281 |
|
|---|
| 282 | //
|
|---|
| 283 | // Transit to next step.
|
|---|
| 284 | //
|
|---|
| 285 | Conn->AuthStep = ISCSI_CHAP_STEP_THREE;
|
|---|
| 286 | break;
|
|---|
| 287 |
|
|---|
| 288 | case ISCSI_CHAP_STEP_THREE:
|
|---|
| 289 | //
|
|---|
| 290 | // One way CHAP authentication and the target would like to
|
|---|
| 291 | // authenticate us.
|
|---|
| 292 | //
|
|---|
| 293 | Status = EFI_SUCCESS;
|
|---|
| 294 | break;
|
|---|
| 295 |
|
|---|
| 296 | case ISCSI_CHAP_STEP_FOUR:
|
|---|
| 297 | ASSERT (AuthData->AuthConfig->CHAPType == ISCSI_CHAP_MUTUAL);
|
|---|
| 298 | //
|
|---|
| 299 | // The forth step, CHAP_N=<N> CHAP_R=<R> is received from Target.
|
|---|
| 300 | //
|
|---|
| 301 | Name = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_NAME);
|
|---|
| 302 | if (Name == NULL) {
|
|---|
| 303 | goto ON_EXIT;
|
|---|
| 304 | }
|
|---|
| 305 |
|
|---|
| 306 | Response = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_CHAP_RESPONSE);
|
|---|
| 307 | if (Response == NULL) {
|
|---|
| 308 | goto ON_EXIT;
|
|---|
| 309 | }
|
|---|
| 310 |
|
|---|
| 311 | RspLen = ISCSI_CHAP_RSP_LEN;
|
|---|
| 312 | IScsiHexToBin (TargetRsp, &RspLen, Response);
|
|---|
| 313 |
|
|---|
| 314 | //
|
|---|
| 315 | // Check the CHAP Name and Response replied by Target.
|
|---|
| 316 | //
|
|---|
| 317 | Status = IScsiCHAPAuthTarget (AuthData, TargetRsp);
|
|---|
| 318 | break;
|
|---|
| 319 |
|
|---|
| 320 | default:
|
|---|
| 321 | break;
|
|---|
| 322 | }
|
|---|
| 323 |
|
|---|
| 324 | ON_EXIT:
|
|---|
| 325 |
|
|---|
| 326 | if (KeyValueList != NULL) {
|
|---|
| 327 | IScsiFreeKeyValueList (KeyValueList);
|
|---|
| 328 | }
|
|---|
| 329 |
|
|---|
| 330 | FreePool (Data);
|
|---|
| 331 |
|
|---|
| 332 | return Status;
|
|---|
| 333 | }
|
|---|
| 334 |
|
|---|
| 335 |
|
|---|
| 336 | /**
|
|---|
| 337 | This function fills the CHAP authentication information into the login PDU
|
|---|
| 338 | during the security negotiation stage in the iSCSI connection login.
|
|---|
| 339 |
|
|---|
| 340 | @param[in] Conn The iSCSI connection.
|
|---|
| 341 | @param[in, out] Pdu The PDU to send out.
|
|---|
| 342 |
|
|---|
| 343 | @retval EFI_SUCCESS All check passed and the phase-related CHAP
|
|---|
| 344 | authentication info is filled into the iSCSI PDU.
|
|---|
| 345 | @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
|
|---|
| 346 | @retval EFI_PROTOCOL_ERROR Some kind of protocol error occurred.
|
|---|
| 347 |
|
|---|
| 348 | **/
|
|---|
| 349 | EFI_STATUS
|
|---|
| 350 | IScsiCHAPToSendReq (
|
|---|
| 351 | IN ISCSI_CONNECTION *Conn,
|
|---|
| 352 | IN OUT NET_BUF *Pdu
|
|---|
| 353 | )
|
|---|
| 354 | {
|
|---|
| 355 | EFI_STATUS Status;
|
|---|
| 356 | ISCSI_SESSION *Session;
|
|---|
| 357 | ISCSI_LOGIN_REQUEST *LoginReq;
|
|---|
| 358 | ISCSI_CHAP_AUTH_DATA *AuthData;
|
|---|
| 359 | CHAR8 *Value;
|
|---|
| 360 | CHAR8 ValueStr[256];
|
|---|
| 361 | CHAR8 *Response;
|
|---|
| 362 | UINT32 RspLen;
|
|---|
| 363 | CHAR8 *Challenge;
|
|---|
| 364 | UINT32 ChallengeLen;
|
|---|
| 365 |
|
|---|
| 366 | ASSERT (Conn->CurrentStage == ISCSI_SECURITY_NEGOTIATION);
|
|---|
| 367 |
|
|---|
| 368 | Session = Conn->Session;
|
|---|
| 369 | AuthData = &Session->AuthData.CHAP;
|
|---|
| 370 | LoginReq = (ISCSI_LOGIN_REQUEST *) NetbufGetByte (Pdu, 0, 0);
|
|---|
| 371 | if (LoginReq == NULL) {
|
|---|
| 372 | return EFI_PROTOCOL_ERROR;
|
|---|
| 373 | }
|
|---|
| 374 | Status = EFI_SUCCESS;
|
|---|
| 375 |
|
|---|
| 376 | RspLen = 2 * ISCSI_CHAP_RSP_LEN + 3;
|
|---|
| 377 | Response = AllocateZeroPool (RspLen);
|
|---|
| 378 | if (Response == NULL) {
|
|---|
| 379 | return EFI_OUT_OF_RESOURCES;
|
|---|
| 380 | }
|
|---|
| 381 |
|
|---|
| 382 | ChallengeLen = 2 * ISCSI_CHAP_RSP_LEN + 3;
|
|---|
| 383 | Challenge = AllocateZeroPool (ChallengeLen);
|
|---|
| 384 | if (Challenge == NULL) {
|
|---|
| 385 | FreePool (Response);
|
|---|
| 386 | return EFI_OUT_OF_RESOURCES;
|
|---|
| 387 | }
|
|---|
| 388 |
|
|---|
| 389 | switch (Conn->AuthStep) {
|
|---|
| 390 | case ISCSI_AUTH_INITIAL:
|
|---|
| 391 | //
|
|---|
| 392 | // It's the initial Login Request. Fill in the key=value pairs mandatory
|
|---|
| 393 | // for the initial Login Request.
|
|---|
| 394 | //
|
|---|
| 395 | IScsiAddKeyValuePair (Pdu, ISCSI_KEY_INITIATOR_NAME, mPrivate->InitiatorName);
|
|---|
| 396 | IScsiAddKeyValuePair (Pdu, ISCSI_KEY_SESSION_TYPE, "Normal");
|
|---|
| 397 | IScsiAddKeyValuePair (
|
|---|
| 398 | Pdu,
|
|---|
| 399 | ISCSI_KEY_TARGET_NAME,
|
|---|
| 400 | Session->ConfigData->SessionConfigData.TargetName
|
|---|
| 401 | );
|
|---|
| 402 |
|
|---|
| 403 | if (Session->AuthType == ISCSI_AUTH_TYPE_NONE) {
|
|---|
| 404 | Value = ISCSI_KEY_VALUE_NONE;
|
|---|
| 405 | ISCSI_SET_FLAG (LoginReq, ISCSI_LOGIN_REQ_PDU_FLAG_TRANSIT);
|
|---|
| 406 | } else {
|
|---|
| 407 | Value = ISCSI_AUTH_METHOD_CHAP;
|
|---|
| 408 | }
|
|---|
| 409 |
|
|---|
| 410 | IScsiAddKeyValuePair (Pdu, ISCSI_KEY_AUTH_METHOD, Value);
|
|---|
| 411 |
|
|---|
| 412 | break;
|
|---|
| 413 |
|
|---|
| 414 | case ISCSI_CHAP_STEP_ONE:
|
|---|
| 415 | //
|
|---|
| 416 | // First step, send the Login Request with CHAP_A=<A1,A2...> key-value pair.
|
|---|
| 417 | //
|
|---|
| 418 | AsciiSPrint (ValueStr, sizeof (ValueStr), "%d", ISCSI_CHAP_ALGORITHM_MD5);
|
|---|
| 419 | IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_ALGORITHM, ValueStr);
|
|---|
| 420 |
|
|---|
| 421 | Conn->AuthStep = ISCSI_CHAP_STEP_TWO;
|
|---|
| 422 | break;
|
|---|
| 423 |
|
|---|
| 424 | case ISCSI_CHAP_STEP_THREE:
|
|---|
| 425 | //
|
|---|
| 426 | // Third step, send the Login Request with CHAP_N=<N> CHAP_R=<R> or
|
|---|
| 427 | // CHAP_N=<N> CHAP_R=<R> CHAP_I=<I> CHAP_C=<C> if target authentication is
|
|---|
| 428 | // required too.
|
|---|
| 429 | //
|
|---|
| 430 | // CHAP_N=<N>
|
|---|
| 431 | //
|
|---|
| 432 | IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_NAME, (CHAR8 *) &AuthData->AuthConfig->CHAPName);
|
|---|
| 433 | //
|
|---|
| 434 | // CHAP_R=<R>
|
|---|
| 435 | //
|
|---|
| 436 | IScsiBinToHex ((UINT8 *) AuthData->CHAPResponse, ISCSI_CHAP_RSP_LEN, Response, &RspLen);
|
|---|
| 437 | IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_RESPONSE, Response);
|
|---|
| 438 |
|
|---|
| 439 | if (AuthData->AuthConfig->CHAPType == ISCSI_CHAP_MUTUAL) {
|
|---|
| 440 | //
|
|---|
| 441 | // CHAP_I=<I>
|
|---|
| 442 | //
|
|---|
| 443 | IScsiGenRandom ((UINT8 *) &AuthData->OutIdentifier, 1);
|
|---|
| 444 | AsciiSPrint (ValueStr, sizeof (ValueStr), "%d", AuthData->OutIdentifier);
|
|---|
| 445 | IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_IDENTIFIER, ValueStr);
|
|---|
| 446 | //
|
|---|
| 447 | // CHAP_C=<C>
|
|---|
| 448 | //
|
|---|
| 449 | IScsiGenRandom ((UINT8 *) AuthData->OutChallenge, ISCSI_CHAP_RSP_LEN);
|
|---|
| 450 | AuthData->OutChallengeLength = ISCSI_CHAP_RSP_LEN;
|
|---|
| 451 | IScsiBinToHex ((UINT8 *) AuthData->OutChallenge, ISCSI_CHAP_RSP_LEN, Challenge, &ChallengeLen);
|
|---|
| 452 | IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_CHALLENGE, Challenge);
|
|---|
| 453 |
|
|---|
| 454 | Conn->AuthStep = ISCSI_CHAP_STEP_FOUR;
|
|---|
| 455 | }
|
|---|
| 456 | //
|
|---|
| 457 | // Set the stage transition flag.
|
|---|
| 458 | //
|
|---|
| 459 | ISCSI_SET_FLAG (LoginReq, ISCSI_LOGIN_REQ_PDU_FLAG_TRANSIT);
|
|---|
| 460 | break;
|
|---|
| 461 |
|
|---|
| 462 | default:
|
|---|
| 463 | Status = EFI_PROTOCOL_ERROR;
|
|---|
| 464 | break;
|
|---|
| 465 | }
|
|---|
| 466 |
|
|---|
| 467 | FreePool (Response);
|
|---|
| 468 | FreePool (Challenge);
|
|---|
| 469 |
|
|---|
| 470 | return Status;
|
|---|
| 471 | }
|
|---|
