|
|
dc245c |
From bcb2950d8ded9ec3a2e3ada8428aeaf725ea2171 Mon Sep 17 00:00:00 2001
|
|
|
dc245c |
From: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
dc245c |
Date: Fri, 3 May 2013 12:47:12 +0200
|
|
|
dc245c |
Subject: [RHEL7 libiscsi PATCH 06/18] use libgcrypt for MD5
|
|
|
dc245c |
|
|
|
dc245c |
This makes sure that CHAP authentication is disabled if the system
|
|
|
dc245c |
is running in FIPS 140-2 mode. MD5 is not a secure algorithm according
|
|
|
dc245c |
to the standard.
|
|
|
dc245c |
|
|
|
dc245c |
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
dc245c |
(cherry-picked from upstream commit bcb2950d8ded9ec3a2e3ada8428aeaf725ea2171)
|
|
|
dc245c |
---
|
|
|
dc245c |
Makefile.am | 6 +++++-
|
|
|
dc245c |
configure.ac | 3 +++
|
|
|
dc245c |
lib/login.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++++--------
|
|
|
dc245c |
3 files changed, 60 insertions(+), 9 deletions(-)
|
|
|
dc245c |
|
|
|
dc245c |
diff --git a/Makefile.am b/Makefile.am
|
|
|
dc245c |
index 5fea7c8..9a8b2b4 100644
|
|
|
dc245c |
--- a/Makefile.am
|
|
|
dc245c |
+++ b/Makefile.am
|
|
|
dc245c |
@@ -34,10 +34,14 @@ dist_noinst_DATA = lib/libiscsi.syms
|
|
|
dc245c |
lib_LTLIBRARIES = lib/libiscsi.la
|
|
|
dc245c |
lib_libiscsi_la_SOURCES = \
|
|
|
dc245c |
lib/connect.c lib/crc32c.c lib/discovery.c lib/init.c \
|
|
|
dc245c |
- lib/login.c lib/md5.c lib/nop.c lib/pdu.c lib/iscsi-command.c \
|
|
|
dc245c |
+ lib/login.c lib/nop.c lib/pdu.c lib/iscsi-command.c \
|
|
|
dc245c |
lib/scsi-lowlevel.c lib/socket.c lib/sync.c lib/task_mgmt.c \
|
|
|
dc245c |
lib/logging.c
|
|
|
dc245c |
|
|
|
dc245c |
+if !HAVE_LIBGCRYPT
|
|
|
dc245c |
+lib_libiscsi_la_SOURCES += lib/md5.c
|
|
|
dc245c |
+endif
|
|
|
dc245c |
+
|
|
|
dc245c |
SONAME=$(firstword $(subst ., ,$(VERSION)))
|
|
|
dc245c |
SOREL=$(shell printf "%d%02d%02d" $(subst ., ,$(VERSION)))
|
|
|
dc245c |
lib_libiscsi_la_LDFLAGS = \
|
|
|
dc245c |
diff --git a/configure.ac b/configure.ac
|
|
|
dc245c |
index 0b45f91..9d06e3a 100644
|
|
|
dc245c |
--- a/configure.ac
|
|
|
dc245c |
+++ b/configure.ac
|
|
|
dc245c |
@@ -18,6 +18,9 @@ AC_SUBST(WARN_CFLAGS)
|
|
|
dc245c |
|
|
|
dc245c |
AC_CONFIG_HEADER(config.h)
|
|
|
dc245c |
|
|
|
dc245c |
+AC_CHECK_LIB([gcrypt], [gcry_control])
|
|
|
dc245c |
+AM_CONDITIONAL([HAVE_LIBGCRYPT], [test $ac_cv_lib_gcrypt_gcry_control = yes])
|
|
|
dc245c |
+
|
|
|
dc245c |
AC_CACHE_CHECK([for sin_len in sock],libiscsi_cv_HAVE_SOCK_SIN_LEN,[
|
|
|
dc245c |
AC_TRY_COMPILE([#include <sys/types.h>
|
|
|
dc245c |
#include <sys/socket.h>
|
|
|
dc245c |
diff --git a/lib/login.c b/lib/login.c
|
|
|
dc245c |
index 07ca3dd..29fe4b3 100644
|
|
|
dc245c |
--- a/lib/login.c
|
|
|
dc245c |
+++ b/lib/login.c
|
|
|
dc245c |
@@ -35,13 +35,18 @@
|
|
|
dc245c |
#include <arpa/inet.h>
|
|
|
dc245c |
#endif
|
|
|
dc245c |
|
|
|
dc245c |
+#include "config.h"
|
|
|
dc245c |
#include <stdio.h>
|
|
|
dc245c |
+#include <assert.h>
|
|
|
dc245c |
#include <stdlib.h>
|
|
|
dc245c |
#include <string.h>
|
|
|
dc245c |
#include "iscsi.h"
|
|
|
dc245c |
#include "iscsi-private.h"
|
|
|
dc245c |
#include "scsi-lowlevel.h"
|
|
|
dc245c |
#include "md5.h"
|
|
|
dc245c |
+#ifdef HAVE_LIBGCRYPT
|
|
|
dc245c |
+#include <gcrypt.h>
|
|
|
dc245c |
+#endif
|
|
|
dc245c |
|
|
|
dc245c |
static int
|
|
|
dc245c |
iscsi_login_add_initiatorname(struct iscsi_context *iscsi, struct iscsi_pdu *pdu)
|
|
|
dc245c |
@@ -628,6 +632,41 @@ i2h(int i)
|
|
|
dc245c |
return i + '0';
|
|
|
dc245c |
}
|
|
|
dc245c |
|
|
|
dc245c |
+#ifndef HAVE_LIBGCRYPT
|
|
|
dc245c |
+typedef struct MD5Context *gcry_md_hd_t;
|
|
|
dc245c |
+#define gcry_md_write MD5Update
|
|
|
dc245c |
+#define GCRY_MD_MD5 1
|
|
|
dc245c |
+
|
|
|
dc245c |
+static inline void gcry_md_open(gcry_md_hd_t *hd, int algo, unsigned int flags)
|
|
|
dc245c |
+{
|
|
|
dc245c |
+ assert(algo == GCRY_MD_MD5 && flags == 0);
|
|
|
dc245c |
+ *hd = malloc(sizeof(struct MD5Context));
|
|
|
dc245c |
+ if (*hd) {
|
|
|
dc245c |
+ MD5Init(*hd);
|
|
|
dc245c |
+ }
|
|
|
dc245c |
+}
|
|
|
dc245c |
+
|
|
|
dc245c |
+static inline void gcry_md_putc(gcry_md_hd_t h, unsigned char c)
|
|
|
dc245c |
+{
|
|
|
dc245c |
+ MD5Update(h, &c, 1);
|
|
|
dc245c |
+}
|
|
|
dc245c |
+
|
|
|
dc245c |
+static inline char *gcry_md_read(gcry_md_hd_t h, int algo)
|
|
|
dc245c |
+{
|
|
|
dc245c |
+ unsigned char digest[16];
|
|
|
dc245c |
+ assert(algo == 0 || algo == GCRY_MD_MD5);
|
|
|
dc245c |
+
|
|
|
dc245c |
+ MD5Final(digest, h);
|
|
|
dc245c |
+ return memcpy(h->buf, digest, sizeof(digest));
|
|
|
dc245c |
+}
|
|
|
dc245c |
+
|
|
|
dc245c |
+static inline void gcry_md_close(gcry_md_hd_t h)
|
|
|
dc245c |
+{
|
|
|
dc245c |
+ memset(h, 0, sizeof(*h));
|
|
|
dc245c |
+ free(h);
|
|
|
dc245c |
+}
|
|
|
dc245c |
+#endif
|
|
|
dc245c |
+
|
|
|
dc245c |
static int
|
|
|
dc245c |
iscsi_login_add_chap_response(struct iscsi_context *iscsi, struct iscsi_pdu *pdu)
|
|
|
dc245c |
{
|
|
|
dc245c |
@@ -635,7 +674,7 @@ iscsi_login_add_chap_response(struct iscsi_context *iscsi, struct iscsi_pdu *pdu
|
|
|
dc245c |
char * strp;
|
|
|
dc245c |
unsigned char c, cc[2];
|
|
|
dc245c |
unsigned char digest[16];
|
|
|
dc245c |
- struct MD5Context ctx;
|
|
|
dc245c |
+ gcry_md_hd_t ctx;
|
|
|
dc245c |
int i;
|
|
|
dc245c |
|
|
|
dc245c |
if (iscsi->current_phase != ISCSI_PDU_LOGIN_CSG_SECNEG
|
|
|
dc245c |
@@ -643,22 +682,27 @@ iscsi_login_add_chap_response(struct iscsi_context *iscsi, struct iscsi_pdu *pdu
|
|
|
dc245c |
return 0;
|
|
|
dc245c |
}
|
|
|
dc245c |
|
|
|
dc245c |
+ gcry_md_open(&ctx, GCRY_MD_MD5, 0);
|
|
|
dc245c |
+ if (!ctx) {
|
|
|
dc245c |
+ iscsi_set_error(iscsi, "Cannot create MD5 algorithm");
|
|
|
dc245c |
+ return -1;
|
|
|
dc245c |
+ }
|
|
|
dc245c |
+
|
|
|
dc245c |
if (!iscsi->chap_c[0]) {
|
|
|
dc245c |
iscsi_set_error(iscsi, "No CHAP challenge found");
|
|
|
dc245c |
return -1;
|
|
|
dc245c |
}
|
|
|
dc245c |
- MD5Init(&ctx;;
|
|
|
dc245c |
- c = iscsi->chap_i;
|
|
|
dc245c |
- MD5Update(&ctx, &c, 1);
|
|
|
dc245c |
- MD5Update(&ctx, (unsigned char *)iscsi->passwd, strlen(iscsi->passwd));
|
|
|
dc245c |
-
|
|
|
dc245c |
+ gcry_md_putc(ctx, iscsi->chap_i);
|
|
|
dc245c |
+ gcry_md_write(ctx, (unsigned char *)iscsi->passwd, strlen(iscsi->passwd));
|
|
|
dc245c |
+
|
|
|
dc245c |
strp = iscsi->chap_c;
|
|
|
dc245c |
while (*strp != 0) {
|
|
|
dc245c |
c = (h2i(strp[0]) << 4) | h2i(strp[1]);
|
|
|
dc245c |
strp += 2;
|
|
|
dc245c |
- MD5Update(&ctx, &c, 1);
|
|
|
dc245c |
+ gcry_md_putc(ctx, c);
|
|
|
dc245c |
}
|
|
|
dc245c |
- MD5Final(digest, &ctx;;
|
|
|
dc245c |
+ memcpy(digest, gcry_md_read(ctx, 0), sizeof(digest));
|
|
|
dc245c |
+ gcry_md_close(ctx);
|
|
|
dc245c |
|
|
|
dc245c |
strncpy(str,"CHAP_R=0x",MAX_STRING_SIZE);
|
|
|
dc245c |
if (iscsi_pdu_add_data(iscsi, pdu, (unsigned char *)str, strlen(str))
|
|
|
dc245c |
--
|
|
|
dc245c |
1.8.1.4
|
|
|
dc245c |
|