From bb33c27fbed6c1ed39d243bedd407e8e93a2b3a9 Mon Sep 17 00:00:00 2001 From: Laszlo Ersek Date: Tue, 29 Jun 2021 18:33:37 +0200 Subject: NetworkPkg: introduce the NETWORK_ISCSI_MD5_ENABLE feature test macro MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Introduce the NETWORK_ISCSI_MD5_ENABLE feature test macro for NetworkPkg. When explicitly set to FALSE, remove MD5 from IScsiDxe's CHAP algorithm list. Set NETWORK_ISCSI_MD5_ENABLE to TRUE by default, for compatibility reasons. Not just to minimize the disruption for platforms that currently include IScsiDxe, but also because RFC 7143 mandates MD5 for CHAP, and some vendors' iSCSI targets support MD5 only. With MD5 enabled, IScsiDxe will suggest SHA256, and then fall back to MD5 if the target requests it. With MD5 disabled, IScsiDxe will suggest SHA256, and break off the connection (and session) if the target doesn't support SHA256. Cc: Jiaxin Wu Cc: Maciej Rabeda Cc: Philippe Mathieu-Daudé Cc: Siyuan Fu Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3355 Signed-off-by: Laszlo Ersek Reviewed-by: Maciej Rabeda Reviewed-by: Philippe Mathieu-Daudé Message-Id: <20210629163337.14120-7-lersek@redhat.com> --- NetworkPkg/IScsiDxe/IScsiCHAP.c | 2 ++ NetworkPkg/NetworkBuildOptions.dsc.inc | 2 +- NetworkPkg/NetworkDefines.dsc.inc | 20 ++++++++++++++++++++ 3 files changed, 23 insertions(+), 1 deletion(-) diff --git a/NetworkPkg/IScsiDxe/IScsiCHAP.c b/NetworkPkg/IScsiDxe/IScsiCHAP.c index 80035ece98..0491ef42db 100644 --- a/NetworkPkg/IScsiDxe/IScsiCHAP.c +++ b/NetworkPkg/IScsiDxe/IScsiCHAP.c @@ -23,6 +23,7 @@ STATIC CONST CHAP_HASH mChapHash[] = { Sha256Update, Sha256Final }, +#ifdef ENABLE_MD5_DEPRECATED_INTERFACES // // Keep the deprecated MD5 entry at the end of the array (making MD5 the // least preferred choice of the initiator). @@ -35,6 +36,7 @@ STATIC CONST CHAP_HASH mChapHash[] = { Md5Update, Md5Final }, +#endif // ENABLE_MD5_DEPRECATED_INTERFACES }; // diff --git a/NetworkPkg/NetworkBuildOptions.dsc.inc b/NetworkPkg/NetworkBuildOptions.dsc.inc index 42d980d954..738da2222f 100644 --- a/NetworkPkg/NetworkBuildOptions.dsc.inc +++ b/NetworkPkg/NetworkBuildOptions.dsc.inc @@ -14,7 +14,7 @@ # ## -!if $(NETWORK_ISCSI_ENABLE) == TRUE +!if $(NETWORK_ISCSI_ENABLE) == TRUE && $(NETWORK_ISCSI_MD5_ENABLE) == TRUE MSFT:*_*_*_CC_FLAGS = /D ENABLE_MD5_DEPRECATED_INTERFACES INTEL:*_*_*_CC_FLAGS = /D ENABLE_MD5_DEPRECATED_INTERFACES GCC:*_*_*_CC_FLAGS = -D ENABLE_MD5_DEPRECATED_INTERFACES diff --git a/NetworkPkg/NetworkDefines.dsc.inc b/NetworkPkg/NetworkDefines.dsc.inc index 54deb6342a..e39a9cb3dc 100644 --- a/NetworkPkg/NetworkDefines.dsc.inc +++ b/NetworkPkg/NetworkDefines.dsc.inc @@ -19,6 +19,7 @@ # DEFINE NETWORK_HTTP_BOOT_ENABLE = TRUE # DEFINE NETWORK_ALLOW_HTTP_CONNECTIONS = FALSE # DEFINE NETWORK_ISCSI_ENABLE = FALSE +# DEFINE NETWORK_ISCSI_MD5_ENABLE = TRUE # DEFINE NETWORK_VLAN_ENABLE = TRUE # # Copyright (c) 2019, Intel Corporation. All rights reserved.
@@ -117,6 +118,25 @@ DEFINE NETWORK_ISCSI_ENABLE = FALSE !endif +!ifndef NETWORK_ISCSI_MD5_ENABLE + # + # This flag enables the deprecated MD5 hash algorithm in iSCSI CHAP + # authentication. + # + # Note: The NETWORK_ISCSI_MD5_ENABLE flag only makes a difference if + # NETWORK_ISCSI_ENABLE is TRUE; otherwise, NETWORK_ISCSI_MD5_ENABLE is + # ignored. + # + # With NETWORK_ISCSI_MD5_ENABLE set to TRUE, MD5 is enabled as the + # least preferred CHAP hash algorithm. With NETWORK_ISCSI_MD5_ENABLE + # set to FALSE, MD5 is disabled statically, at build time. + # + # The default value is TRUE, because RFC 7143 mandates MD5, and because + # several vendors' iSCSI targets only support MD5, for CHAP. + # + DEFINE NETWORK_ISCSI_MD5_ENABLE = TRUE +!endif + !if $(NETWORK_ENABLE) == TRUE # # Check the flags to see if there is any conflict. -- cgit v1.2.3