summaryrefslogtreecommitdiffstats
path: root/NetworkPkg
diff options
context:
space:
mode:
authorLaszlo Ersek <lersek@redhat.com>2021-06-29 18:33:37 +0200
committermergify[bot] <37929162+mergify[bot]@users.noreply.github.com>2021-06-30 19:20:41 +0000
commitbb33c27fbed6c1ed39d243bedd407e8e93a2b3a9 (patch)
treefbf909638717d0a9256a0920ae1c655f8e6e827f /NetworkPkg
parent47fea2abcb8b73a503568e1e2bb83a52d00a73b2 (diff)
downloadedk2-bb33c27fbed6c1ed39d243bedd407e8e93a2b3a9.tar.gz
edk2-bb33c27fbed6c1ed39d243bedd407e8e93a2b3a9.tar.bz2
edk2-bb33c27fbed6c1ed39d243bedd407e8e93a2b3a9.zip
NetworkPkg: introduce the NETWORK_ISCSI_MD5_ENABLE feature test macro
Introduce the NETWORK_ISCSI_MD5_ENABLE feature test macro for NetworkPkg. When explicitly set to FALSE, remove MD5 from IScsiDxe's CHAP algorithm list. Set NETWORK_ISCSI_MD5_ENABLE to TRUE by default, for compatibility reasons. Not just to minimize the disruption for platforms that currently include IScsiDxe, but also because RFC 7143 mandates MD5 for CHAP, and some vendors' iSCSI targets support MD5 only. With MD5 enabled, IScsiDxe will suggest SHA256, and then fall back to MD5 if the target requests it. With MD5 disabled, IScsiDxe will suggest SHA256, and break off the connection (and session) if the target doesn't support SHA256. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3355 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210629163337.14120-7-lersek@redhat.com>
Diffstat (limited to 'NetworkPkg')
-rw-r--r--NetworkPkg/IScsiDxe/IScsiCHAP.c2
-rw-r--r--NetworkPkg/NetworkBuildOptions.dsc.inc2
-rw-r--r--NetworkPkg/NetworkDefines.dsc.inc20
3 files changed, 23 insertions, 1 deletions
diff --git a/NetworkPkg/IScsiDxe/IScsiCHAP.c b/NetworkPkg/IScsiDxe/IScsiCHAP.c
index 80035ece98..0491ef42db 100644
--- a/NetworkPkg/IScsiDxe/IScsiCHAP.c
+++ b/NetworkPkg/IScsiDxe/IScsiCHAP.c
@@ -23,6 +23,7 @@ STATIC CONST CHAP_HASH mChapHash[] = {
Sha256Update,
Sha256Final
},
+#ifdef ENABLE_MD5_DEPRECATED_INTERFACES
//
// Keep the deprecated MD5 entry at the end of the array (making MD5 the
// least preferred choice of the initiator).
@@ -35,6 +36,7 @@ STATIC CONST CHAP_HASH mChapHash[] = {
Md5Update,
Md5Final
},
+#endif // ENABLE_MD5_DEPRECATED_INTERFACES
};
//
diff --git a/NetworkPkg/NetworkBuildOptions.dsc.inc b/NetworkPkg/NetworkBuildOptions.dsc.inc
index 42d980d954..738da2222f 100644
--- a/NetworkPkg/NetworkBuildOptions.dsc.inc
+++ b/NetworkPkg/NetworkBuildOptions.dsc.inc
@@ -14,7 +14,7 @@
#
##
-!if $(NETWORK_ISCSI_ENABLE) == TRUE
+!if $(NETWORK_ISCSI_ENABLE) == TRUE && $(NETWORK_ISCSI_MD5_ENABLE) == TRUE
MSFT:*_*_*_CC_FLAGS = /D ENABLE_MD5_DEPRECATED_INTERFACES
INTEL:*_*_*_CC_FLAGS = /D ENABLE_MD5_DEPRECATED_INTERFACES
GCC:*_*_*_CC_FLAGS = -D ENABLE_MD5_DEPRECATED_INTERFACES
diff --git a/NetworkPkg/NetworkDefines.dsc.inc b/NetworkPkg/NetworkDefines.dsc.inc
index 54deb6342a..e39a9cb3dc 100644
--- a/NetworkPkg/NetworkDefines.dsc.inc
+++ b/NetworkPkg/NetworkDefines.dsc.inc
@@ -19,6 +19,7 @@
# DEFINE NETWORK_HTTP_BOOT_ENABLE = TRUE
# DEFINE NETWORK_ALLOW_HTTP_CONNECTIONS = FALSE
# DEFINE NETWORK_ISCSI_ENABLE = FALSE
+# DEFINE NETWORK_ISCSI_MD5_ENABLE = TRUE
# DEFINE NETWORK_VLAN_ENABLE = TRUE
#
# Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
@@ -117,6 +118,25 @@
DEFINE NETWORK_ISCSI_ENABLE = FALSE
!endif
+!ifndef NETWORK_ISCSI_MD5_ENABLE
+ #
+ # This flag enables the deprecated MD5 hash algorithm in iSCSI CHAP
+ # authentication.
+ #
+ # Note: The NETWORK_ISCSI_MD5_ENABLE flag only makes a difference if
+ # NETWORK_ISCSI_ENABLE is TRUE; otherwise, NETWORK_ISCSI_MD5_ENABLE is
+ # ignored.
+ #
+ # With NETWORK_ISCSI_MD5_ENABLE set to TRUE, MD5 is enabled as the
+ # least preferred CHAP hash algorithm. With NETWORK_ISCSI_MD5_ENABLE
+ # set to FALSE, MD5 is disabled statically, at build time.
+ #
+ # The default value is TRUE, because RFC 7143 mandates MD5, and because
+ # several vendors' iSCSI targets only support MD5, for CHAP.
+ #
+ DEFINE NETWORK_ISCSI_MD5_ENABLE = TRUE
+!endif
+
!if $(NETWORK_ENABLE) == TRUE
#
# Check the flags to see if there is any conflict.