commit 95616b866187b00355042953efa5c198df07250f
author Laszlo Ersek <lersek@redhat.com> Tue Jun 08 14:12:52 2021 +0200
committer mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> Wed Jun 09 17:25:03 2021 +0000
tree 3947d24cc39de9844cdd919f0b97bc5c5011485b
parent 29cab43bb7912a12efa5a78dac15394aee866e4c

NetworkPkg/IScsiDxe: clean up "ISCSI_CHAP_AUTH_DATA.OutChallengeLength"

The "ISCSI_CHAP_AUTH_DATA.OutChallenge" field is declared as a UINT8 array
with ISCSI_CHAP_AUTH_MAX_LEN (1024) elements. However, when the challenge
is generated and formatted, only ISCSI_CHAP_RSP_LEN (16) octets are used
in the array.

Change the array size to ISCSI_CHAP_RSP_LEN, and remove the (now unused)
ISCSI_CHAP_AUTH_MAX_LEN macro.

Remove the "ISCSI_CHAP_AUTH_DATA.OutChallengeLength" field, which is
superfluous too.

Most importantly, explain in a new comment *why* tying the challenge size
to the digest size (ISCSI_CHAP_RSP_LEN) has always made sense. (See also
Linux kernel commit 19f5f88ed779, "scsi: target: iscsi: tie the challenge
length to the hash digest size", 2019-11-06.) For sure, the motivation
that the new comment now explains has always been there, and has always
been the same, for IScsiDxe; it's just that now we spell it out too.

No change in peer-visible behavior.

Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Message-Id: <20210608121259.32451-4-lersek@redhat.com>

NetworkPkg/IScsiDxe/IScsiCHAP.c

diff --git a/NetworkPkg/IScsiDxe/IScsiCHAP.c b/NetworkPkg/IScsiDxe/IScsiCHAP.c
index df3c2eb..9e192ce 100644
--- a/NetworkPkg/IScsiDxe/IScsiCHAP.c
+++ b/NetworkPkg/IScsiDxe/IScsiCHAP.c
@@ -122,7 +122,7 @@
              AuthData->AuthConfig->ReverseCHAPSecret,

              SecretSize,

              AuthData->OutChallenge,

-             AuthData->OutChallengeLength,

+             ISCSI_CHAP_RSP_LEN,                      // ChallengeLength

              VerifyRsp

              );

 

@@ -490,7 +490,6 @@
       // CHAP_C=<C>

       //

       IScsiGenRandom ((UINT8 *) AuthData->OutChallenge, ISCSI_CHAP_RSP_LEN);

-      AuthData->OutChallengeLength = ISCSI_CHAP_RSP_LEN;

       IScsiBinToHex (

         (UINT8 *) AuthData->OutChallenge,

         ISCSI_CHAP_RSP_LEN,

NetworkPkg/IScsiDxe/IScsiCHAP.h

diff --git a/NetworkPkg/IScsiDxe/IScsiCHAP.h b/NetworkPkg/IScsiDxe/IScsiCHAP.h
index 1fc1d96..35d5d6e 100644
--- a/NetworkPkg/IScsiDxe/IScsiCHAP.h
+++ b/NetworkPkg/IScsiDxe/IScsiCHAP.h
@@ -19,7 +19,6 @@
 

 #define ISCSI_CHAP_ALGORITHM_MD5  5

 

-#define ISCSI_CHAP_AUTH_MAX_LEN   1024

 ///

 /// MD5_HASHSIZE

 ///

@@ -59,9 +58,13 @@
   //

   // Auth-data to be sent out for mutual authentication.

   //

+  // While the challenge size is technically independent of the hashing

+  // algorithm, it is good practice to avoid hashing *fewer bytes* than the

+  // digest size. In other words, it's good practice to feed *at least as many

+  // bytes* to the hashing algorithm as the hashing algorithm will output.

+  //

   UINT32                        OutIdentifier;

-  UINT8                         OutChallenge[ISCSI_CHAP_AUTH_MAX_LEN];

-  UINT32                        OutChallengeLength;

+  UINT8                         OutChallenge[ISCSI_CHAP_RSP_LEN];

 } ISCSI_CHAP_AUTH_DATA;

 

 /**