1 /* $NetBSD: iscsi_text.c,v 1.6 2012/08/12 13:26:18 mlelstv Exp $ */ 2 3 /*- 4 * Copyright (c) 2005,2006,2011 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Wasabi Systems, Inc. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #include "iscsi_globals.h" 33 #include "base64.h" 34 #include <sys/md5.h> 35 #include <sys/cprng.h> 36 37 /* define to send T_BIGNUM in hex format instead of base64 */ 38 /* #define ISCSI_HEXBIGNUMS */ 39 40 #define isdigit(x) ((x) >= '0' && (x) <= '9') 41 #define toupper(x) ((x) & ~0x20) 42 43 /*****************************************************************************/ 44 45 #define MAX_STRING 255 /* Maximum length of parameter value */ 46 #define MAX_LIST 4 /* Maximum number of list elements we'll ever send */ 47 48 /* Maximum number of negotiation parameters in the operational negotiation phase */ 49 /* 48 should be more than enough even with the target defining its own keys */ 50 #define MAX_NEG 48 51 52 #define CHAP_CHALLENGE_LEN 32 /* Number of bytes to send in challenge */ 53 #define CHAP_MD5_SIZE 16 /* Number of bytes in MD5 hash */ 54 55 /*****************************************************************************/ 56 57 /* authentication states */ 58 59 typedef enum 60 { 61 AUTH_INITIAL, /* sending choice of algorithms */ 62 AUTH_METHOD_SELECTED, /* received choice, sending first parameter */ 63 /* from here it's alg dependent */ 64 AUTH_CHAP_ALG_SENT, /* CHAP: Algorithm selected */ 65 AUTH_CHAP_RSP_SENT, /* CHAP: Response sent */ 66 /* for all algorithms */ 67 AUTH_DONE /* in parameter negotiation stage */ 68 } auth_state_t; 69 70 71 /* enumeration of all the keys we know, and a place for the ones we don't */ 72 73 typedef enum 74 { 75 K_AuthMethod, 76 K_Auth_CHAP_Algorithm, 77 K_Auth_CHAP_Challenge, 78 K_Auth_CHAP_Identifier, 79 K_Auth_CHAP_Name, 80 K_Auth_CHAP_Response, 81 K_DataDigest, 82 K_DataPDUInOrder, 83 K_DataSequenceInOrder, 84 K_DefaultTime2Retain, 85 K_DefaultTime2Wait, 86 K_ErrorRecoveryLevel, 87 K_FirstBurstLength, 88 K_HeaderDigest, 89 K_IFMarker, 90 K_IFMarkInt, 91 K_ImmediateData, 92 K_InitialR2T, 93 K_InitiatorAlias, 94 K_InitiatorName, 95 K_MaxBurstLength, 96 K_MaxConnections, 97 K_MaxOutstandingR2T, 98 K_MaxRecvDataSegmentLength, 99 K_OFMarker, 100 K_OFMarkInt, 101 K_SendTargets, 102 K_SessionType, 103 K_TargetAddress, 104 K_TargetAlias, 105 K_TargetName, 106 K_TargetPortalGroupTag, 107 K_NotUnderstood 108 } text_key_t; 109 110 /* maximum known key */ 111 #define MAX_KEY K_TargetPortalGroupTag 112 113 114 #undef DEBOUT 115 #define DEBOUT(x) printf x 116 117 118 119 /* value types */ 120 typedef enum 121 { /* Value is... */ 122 T_NUM, /* numeric */ 123 T_BIGNUM, /* large numeric */ 124 T_STRING, /* string */ 125 T_YESNO, /* boolean (Yes or No) */ 126 T_AUTH, /* authentication type (CHAP or None for now) */ 127 T_DIGEST, /* digest (None or CRC32C) */ 128 T_RANGE, /* numeric range */ 129 T_SENDT, /* send target options (ALL, target-name, empty) */ 130 T_SESS /* session type (Discovery or Normal) */ 131 } val_kind_t; 132 133 134 /* table of negotiation key strings with value type and default */ 135 136 typedef struct 137 { 138 const uint8_t *name; /* the key name */ 139 val_kind_t val; /* the value type */ 140 uint32_t defval; /* default value */ 141 } key_entry_t; 142 143 STATIC key_entry_t entries[] = { 144 {"AuthMethod", T_AUTH, 0}, 145 {"CHAP_A", T_NUM, 5}, 146 {"CHAP_C", T_BIGNUM, 0}, 147 {"CHAP_I", T_NUM, 0}, 148 {"CHAP_N", T_STRING, 0}, 149 {"CHAP_R", T_BIGNUM, 0}, 150 {"DataDigest", T_DIGEST, 0}, 151 {"DataPDUInOrder", T_YESNO, 1}, 152 {"DataSequenceInOrder", T_YESNO, 1}, 153 {"DefaultTime2Retain", T_NUM, 20}, 154 {"DefaultTime2Wait", T_NUM, 2}, 155 {"ErrorRecoveryLevel", T_NUM, 0}, 156 {"FirstBurstLength", T_NUM, 64 * 1024}, 157 {"HeaderDigest", T_DIGEST, 0}, 158 {"IFMarker", T_YESNO, 0}, 159 {"IFMarkInt", T_RANGE, 2048}, 160 {"ImmediateData", T_YESNO, 1}, 161 {"InitialR2T", T_YESNO, 1}, 162 {"InitiatorAlias", T_STRING, 0}, 163 {"InitiatorName", T_STRING, 0}, 164 {"MaxBurstLength", T_NUM, 256 * 1024}, 165 {"MaxConnections", T_NUM, 1}, 166 {"MaxOutstandingR2T", T_NUM, 1}, 167 {"MaxRecvDataSegmentLength", T_NUM, 8192}, 168 {"OFMarker", T_YESNO, 0}, 169 {"OFMarkInt", T_RANGE, 2048}, 170 {"SendTargets", T_SENDT, 0}, 171 {"SessionType", T_SESS, 0}, 172 {"TargetAddress", T_STRING, 0}, 173 {"TargetAlias", T_STRING, 0}, 174 {"TargetName", T_STRING, 0}, 175 {"TargetPortalGroupTag", T_NUM, 0}, 176 {NULL, T_STRING, 0} 177 }; 178 179 /* a negotiation parameter: key and values (there may be more than 1 for lists) */ 180 typedef struct 181 { 182 text_key_t key; /* the key */ 183 int list_num; /* number of elements in list, doubles as */ 184 /* data size for large numeric values */ 185 union 186 { 187 uint32_t nval[MAX_LIST]; /* numeric or enumeration values */ 188 uint8_t *sval; /* string or data pointer */ 189 } val; 190 } negotiation_parameter_t; 191 192 193 /* Negotiation state flags */ 194 #define NS_SENT 0x01 /* key was sent to target */ 195 #define NS_RECEIVED 0x02 /* key was received from target */ 196 197 typedef struct 198 { 199 negotiation_parameter_t pars[MAX_NEG]; /* the parameters to send */ 200 negotiation_parameter_t *cpar; /* the last parameter set */ 201 uint16_t num_pars; /* number of parameters to send */ 202 auth_state_t auth_state; /* authentication state */ 203 iscsi_auth_types_t auth_alg; /* authentication algorithm */ 204 uint8_t kflags[MAX_KEY + 2]; /* negotiation flags for each key */ 205 uint8_t password[MAX_STRING + 1]; /* authentication secret */ 206 uint8_t target_password[MAX_STRING + 1]; /* target authentication secret */ 207 uint8_t user_name[MAX_STRING + 1]; /* authentication user ID */ 208 uint8_t temp_buf[MAX_STRING + 1]; /* scratch buffer */ 209 210 bool HeaderDigest; 211 bool DataDigest; 212 bool InitialR2T; 213 bool ImmediateData; 214 uint32_t ErrorRecoveryLevel; 215 uint32_t MaxRecvDataSegmentLength; 216 uint32_t MaxConnections; 217 uint32_t DefaultTime2Wait; 218 uint32_t DefaultTime2Retain; 219 uint32_t MaxBurstLength; 220 uint32_t FirstBurstLength; 221 uint32_t MaxOutstandingR2T; 222 223 } negotiation_state_t; 224 225 226 #define TX(state, key) (state->kflags [key] & NS_SENT) 227 #define RX(state, key) (state->kflags [key] & NS_RECEIVED) 228 229 /*****************************************************************************/ 230 231 232 STATIC void 233 chap_md5_response(uint8_t *buffer, uint8_t identifier, uint8_t *secret, 234 uint8_t *challenge, int challenge_size) 235 { 236 MD5_CTX md5; 237 238 MD5Init(&md5); 239 MD5Update(&md5, &identifier, 1); 240 MD5Update(&md5, secret, strlen(secret)); 241 MD5Update(&md5, challenge, challenge_size); 242 MD5Final(buffer, &md5); 243 } 244 245 246 /*****************************************************************************/ 247 248 /* 249 * hexdig: 250 * Return value of hex digit. 251 * Note: a null character is acceptable, and returns 0. 252 * 253 * Parameter: 254 * c The character 255 * 256 * Returns: The value, -1 on error. 257 */ 258 259 static __inline int 260 hexdig(uint8_t c) 261 { 262 263 if (!c) { 264 return 0; 265 } 266 if (isdigit(c)) { 267 return c - '0'; 268 } 269 c = toupper(c); 270 if (c >= 'A' && c <= 'F') { 271 return c - 'A' + 10; 272 } 273 return -1; 274 } 275 276 /* 277 * skiptozero: 278 * Skip to next zero character in buffer. 279 * 280 * Parameter: 281 * buf The buffer pointer 282 * 283 * Returns: The pointer to the character after the zero character. 284 */ 285 286 static __inline uint8_t * 287 skiptozero(uint8_t *buf) 288 { 289 290 while (*buf) { 291 buf++; 292 } 293 return buf + 1; 294 } 295 296 297 /* 298 * get_bignumval: 299 * Get a large numeric value. 300 * NOTE: Overwrites source string. 301 * 302 * Parameter: 303 * buf The buffer pointer 304 * par The parameter 305 * 306 * Returns: The pointer to the next parameter, NULL on error. 307 */ 308 309 STATIC uint8_t * 310 get_bignumval(uint8_t *buf, negotiation_parameter_t *par) 311 { 312 int val; 313 char c; 314 uint8_t *dp = buf; 315 316 par->val.sval = buf; 317 318 if (buf[0] == '0' && (buf[1] == 'x' || buf[1] == 'X')) { 319 buf += 2; 320 while ((c = *buf) != 0x0) { 321 buf++; 322 val = (hexdig(c) << 4) | hexdig(*buf); 323 if (val < 0) { 324 return NULL; 325 } 326 *dp++ = (uint8_t) val; 327 if (*buf) { 328 buf++; 329 } 330 } 331 buf++; 332 par->list_num = dp - par->val.sval; 333 } else if (buf[0] == '0' && (buf[1] == 'b' || buf[1] == 'B')) { 334 buf = base64_decode(&buf[2], par->val.sval, &par->list_num); 335 } else { 336 DEBOUT(("Ill-formatted large number <%s>\n", buf)); 337 return NULL; 338 } 339 340 return buf; 341 } 342 343 344 /* 345 * get_numval: 346 * Get a numeric value. 347 * 348 * Parameter: 349 * buf The buffer pointer 350 * pval The pointer to the result. 351 * 352 * Returns: The pointer to the next parameter, NULL on error. 353 */ 354 355 STATIC uint8_t * 356 get_numval(uint8_t *buf, uint32_t *pval) 357 { 358 uint32_t val = 0; 359 char c; 360 361 if (buf[0] == '0' && (buf[1] == 'x' || buf[1] == 'X')) { 362 buf += 2; 363 while (*buf && *buf != '~') { 364 int n; 365 366 if ((n = hexdig(*buf++)) < 0) 367 return NULL; 368 val = (val << 4) | n; 369 } 370 } else 371 while (*buf && *buf != '~') { 372 c = *buf++; 373 if (!isdigit(c)) 374 return NULL; 375 val = val * 10 + (c - '0'); 376 } 377 378 *pval = val; 379 380 return buf + 1; 381 } 382 383 384 /* 385 * get_range: 386 * Get a numeric range. 387 * 388 * Parameter: 389 * buf The buffer pointer 390 * pval1 The pointer to the first result. 391 * pval2 The pointer to the second result. 392 * 393 * Returns: The pointer to the next parameter, NULL on error. 394 */ 395 396 STATIC uint8_t * 397 get_range(uint8_t *buf, uint32_t *pval1, uint32_t *pval2) 398 { 399 400 if ((buf = get_numval(buf, pval1)) == NULL) 401 return NULL; 402 if (!*buf) 403 return NULL; 404 if ((buf = get_numval(buf, pval2)) == NULL) 405 return NULL; 406 return buf; 407 } 408 409 410 /* 411 * get_ynval: 412 * Get a yes/no selection. 413 * 414 * Parameter: 415 * buf The buffer pointer 416 * pval The pointer to the result. 417 * 418 * Returns: The pointer to the next parameter, NULL on error. 419 */ 420 421 STATIC uint8_t * 422 get_ynval(uint8_t *buf, uint32_t *pval) 423 { 424 425 if (strcmp(buf, "Yes") == 0) 426 *pval = 1; 427 else if (strcmp(buf, "No") == 0) 428 *pval = 0; 429 else 430 return NULL; 431 432 return skiptozero(buf); 433 } 434 435 436 /* 437 * get_digestval: 438 * Get a digest selection. 439 * 440 * Parameter: 441 * buf The buffer pointer 442 * pval The pointer to the result. 443 * 444 * Returns: The pointer to the next parameter, NULL on error. 445 */ 446 447 STATIC uint8_t * 448 get_digestval(uint8_t *buf, uint32_t *pval) 449 { 450 451 if (strcmp(buf, "CRC32C") == 0) 452 *pval = 1; 453 else if (strcmp(buf, "None") == 0) 454 *pval = 0; 455 else 456 return NULL; 457 458 return skiptozero(buf); 459 } 460 461 462 /* 463 * get_authval: 464 * Get an authentication method. 465 * 466 * Parameter: 467 * buf The buffer pointer 468 * pval The pointer to the result. 469 * 470 * Returns: The pointer to the next parameter, NULL on error. 471 */ 472 473 STATIC uint8_t * 474 get_authval(uint8_t *buf, uint32_t *pval) 475 { 476 477 if (strcmp(buf, "None") == 0) 478 *pval = ISCSI_AUTH_None; 479 else if (strcmp(buf, "CHAP") == 0) 480 *pval = ISCSI_AUTH_CHAP; 481 else if (strcmp(buf, "KRB5") == 0) 482 *pval = ISCSI_AUTH_KRB5; 483 else if (strcmp(buf, "SRP") == 0) 484 *pval = ISCSI_AUTH_SRP; 485 else 486 return NULL; 487 488 return skiptozero(buf); 489 } 490 491 492 /* 493 * get_strval: 494 * Get a string value (returns pointer to original buffer, not a copy). 495 * 496 * Parameter: 497 * buf The buffer pointer 498 * pval The pointer to the result pointer. 499 * 500 * Returns: The pointer to the next parameter, NULL on error. 501 */ 502 503 STATIC uint8_t * 504 get_strval(uint8_t *buf, uint8_t **pval) 505 { 506 507 if (strlen(buf) > MAX_STRING) 508 return NULL; 509 510 *pval = buf; 511 512 return skiptozero(buf); 513 } 514 515 516 /* 517 * get_parameter: 518 * Analyze a key=value string. 519 * NOTE: The string is modified in the process. 520 * 521 * Parameter: 522 * buf The buffer pointer 523 * par The parameter descriptor to be filled in 524 * 525 * Returns: The pointer to the next parameter, NULL on error. 526 */ 527 528 STATIC uint8_t * 529 get_parameter(uint8_t *buf, negotiation_parameter_t *par) 530 { 531 uint8_t *bp = buf; 532 int i; 533 534 while (*bp && *bp != '=') { 535 bp++; 536 } 537 if (!*bp) { 538 DEBOUT(("get_parameter: Premature end of parameter\n")); 539 return NULL; 540 } 541 542 *bp++ = 0; 543 544 for (i = 0; i <= MAX_KEY; i++) 545 if (!strcmp(buf, entries[i].name)) 546 break; 547 548 par->key = i; 549 par->list_num = 1; 550 551 if (i > MAX_KEY) { 552 DEBOUT(("get_parameter: unrecognized key <%s>\n", buf)); 553 if (strlen(buf) > MAX_STRING) { 554 DEBOUT(("get_parameter: key name > MAX_STRING\n")); 555 return NULL; 556 } 557 par->val.sval = buf; 558 return skiptozero(bp); 559 } 560 561 DEB(10, ("get_par: key <%s>=%d, val=%d, ret %p\n", 562 buf, i, entries[i].val, bp)); 563 DEB(10, ("get_par: value '%s'\n",bp)); 564 565 switch (entries[i].val) { 566 case T_NUM: 567 bp = get_numval(bp, &par->val.nval[0]); 568 break; 569 570 case T_BIGNUM: 571 bp = get_bignumval(bp, par); 572 break; 573 574 case T_STRING: 575 bp = get_strval(bp, &par->val.sval); 576 break; 577 578 case T_YESNO: 579 bp = get_ynval(bp, &par->val.nval[0]); 580 break; 581 582 case T_AUTH: 583 bp = get_authval(bp, &par->val.nval[0]); 584 break; 585 586 case T_DIGEST: 587 bp = get_digestval(bp, &par->val.nval[0]); 588 break; 589 590 case T_RANGE: 591 bp = get_range(bp, &par->val.nval[0], &par->val.nval[1]); 592 break; 593 594 default: 595 /* Target sending any other types is wrong */ 596 bp = NULL; 597 break; 598 } 599 return bp; 600 } 601 602 /*****************************************************************************/ 603 604 /* 605 * my_strcpy: 606 * Replacement for strcpy that returns the end of the result string 607 * 608 * Parameter: 609 * dest The destination buffer pointer 610 * src The source string 611 * 612 * Returns: A pointer to the terminating zero of the result. 613 */ 614 615 static __inline unsigned 616 my_strcpy(uint8_t *dest, const uint8_t *src) 617 { 618 unsigned cc; 619 620 for (cc = 0 ; (*dest = *src) != 0x0 ; cc++) { 621 dest++; 622 src++; 623 } 624 return cc; 625 } 626 627 /* 628 * put_bignumval: 629 * Write a large numeric value. 630 * NOTE: Overwrites source string. 631 * 632 * Parameter: 633 * buf The buffer pointer 634 * par The parameter 635 * 636 * Returns: The pointer to the next parameter, NULL on error. 637 */ 638 639 STATIC unsigned 640 put_bignumval(negotiation_parameter_t *par, uint8_t *buf) 641 { 642 #ifdef ISCSI_HEXBIGNUMS 643 int k, c; 644 645 my_strcpy(buf, "0x"); 646 for (k=0; k<par->list_num; ++k) { 647 c = par->val.sval[k] >> 4; 648 buf[2+2*k] = c < 10 ? '0' + c : 'a' + (c-10); 649 c = par->val.sval[k] & 0xf; 650 buf[2+2*k+1] = c < 10 ? '0' + c : 'a' + (c-10); 651 } 652 buf[2+2*k] = '\0'; 653 654 return 2+2*par->list_num; 655 #else 656 return base64_encode(par->val.sval, par->list_num, buf); 657 #endif 658 } 659 660 /* 661 * put_parameter: 662 * Create a key=value string. 663 * 664 * Parameter: 665 * buf The buffer pointer 666 * par The parameter descriptor 667 * 668 * Returns: The pointer to the next free buffer space, NULL on error. 669 */ 670 671 STATIC unsigned 672 put_parameter(uint8_t *buf, unsigned len, negotiation_parameter_t *par) 673 { 674 int i; 675 unsigned cc, cl; 676 const uint8_t *sp; 677 678 DEB(10, ("put_par: key <%s>=%d, val=%d\n", 679 entries[par->key].name, par->key, entries[par->key].val)); 680 681 if (par->key > MAX_KEY) { 682 return snprintf(buf, len, "%s=NotUnderstood", par->val.sval); 683 } 684 685 cc = snprintf(buf, len, "%s=", entries[par->key].name); 686 687 for (i = 0; i < par->list_num; i++) { 688 switch (entries[par->key].val) { 689 case T_NUM: 690 cl = snprintf(&buf[cc], len - cc, "%d", 691 par->val.nval[i]); 692 break; 693 694 case T_BIGNUM: 695 cl = put_bignumval(par, &buf[cc]); 696 i = par->list_num; 697 break; 698 699 case T_STRING: 700 cl = my_strcpy(&buf[cc], par->val.sval); 701 break; 702 703 case T_YESNO: 704 cl = my_strcpy(&buf[cc], 705 (par->val.nval[i]) ? "Yes" : "No"); 706 break; 707 708 case T_AUTH: 709 switch (par->val.nval[i]) { 710 case ISCSI_AUTH_CHAP: 711 sp = "CHAP"; 712 break; 713 case ISCSI_AUTH_KRB5: 714 sp = "KRB5"; 715 break; 716 case ISCSI_AUTH_SRP: 717 sp = "SRP"; 718 break; 719 default: 720 sp = "None"; 721 break; 722 } 723 cl = my_strcpy(&buf[cc], sp); 724 break; 725 726 case T_DIGEST: 727 cl = my_strcpy(&buf[cc], 728 (par->val.nval[i]) ? "CRC32C" : "None"); 729 break; 730 731 case T_RANGE: 732 if ((i + 1) >= par->list_num) { 733 cl = my_strcpy(&buf[cc], "Reject"); 734 } else { 735 cl = snprintf(&buf[cc], len - cc, 736 "%d~%d", par->val.nval[i], 737 par->val.nval[i + 1]); 738 i++; 739 } 740 break; 741 742 case T_SENDT: 743 cl = my_strcpy(&buf[cc], par->val.sval); 744 break; 745 746 case T_SESS: 747 cl = my_strcpy(&buf[cc], 748 (par->val.nval[i]) ? "Normal" : "Discovery"); 749 break; 750 751 default: 752 cl = 0; 753 /* We should't be here... */ 754 DEBOUT(("Invalid type %d in put_parameter!\n", 755 entries[par->key].val)); 756 break; 757 } 758 759 DEB(10, ("put_par: value '%s'\n",&buf[cc])); 760 761 cc += cl; 762 if ((i + 1) < par->list_num) { 763 buf[cc++] = ','; 764 } 765 } 766 767 buf[cc] = 0x0; /* make sure it's terminated */ 768 return cc + 1; /* return next place in list */ 769 } 770 771 772 /* 773 * put_par_block: 774 * Fill a parameter block 775 * 776 * Parameter: 777 * buf The buffer pointer 778 * pars The parameter descriptor array 779 * n The number of elements 780 * 781 * Returns: result from put_parameter (ptr to buffer, NULL on error) 782 */ 783 784 static __inline unsigned 785 put_par_block(uint8_t *buf, unsigned len, negotiation_parameter_t *pars, int n) 786 { 787 unsigned cc; 788 int i; 789 790 for (cc = 0, i = 0; i < n; i++) { 791 cc += put_parameter(&buf[cc], len - cc, pars++); 792 if (cc >= len) { 793 break; 794 } 795 } 796 return cc; 797 } 798 799 /* 800 * parameter_size: 801 * Determine the size of a key=value string. 802 * 803 * Parameter: 804 * par The parameter descriptor 805 * 806 * Returns: The size of the resulting string. 807 */ 808 809 STATIC int 810 parameter_size(negotiation_parameter_t *par) 811 { 812 int i, size; 813 char buf[24]; /* max. 2 10-digit numbers + sep. */ 814 815 if (par->key > MAX_KEY) { 816 return strlen(par->val.sval) + 15; 817 } 818 /* count '=' and terminal zero */ 819 size = strlen(entries[par->key].name) + 2; 820 821 for (i = 0; i < par->list_num; i++) { 822 switch (entries[par->key].val) { 823 case T_NUM: 824 size += snprintf(buf, sizeof(buf), "%d", 825 par->val.nval[i]); 826 break; 827 828 case T_BIGNUM: 829 /* list_num holds value size */ 830 #ifdef ISCSI_HEXBIGNUMS 831 size += 2 + 2*par->list_num; 832 #else 833 size += base64_enclen(par->list_num); 834 #endif 835 i = par->list_num; 836 break; 837 838 case T_STRING: 839 case T_SENDT: 840 size += strlen(par->val.sval); 841 break; 842 843 case T_YESNO: 844 size += (par->val.nval[i]) ? 3 : 2; 845 break; 846 847 case T_AUTH: 848 size += (par->val.nval[i] == ISCSI_AUTH_SRP) ? 3 : 4; 849 break; 850 851 case T_DIGEST: 852 size += (par->val.nval[i]) ? 6 : 4; 853 break; 854 855 case T_RANGE: 856 assert((i + 1) < par->list_num); 857 size += snprintf(buf, sizeof(buf), "%d~%d", 858 par->val.nval[i], 859 par->val.nval[i + 1]); 860 i++; 861 break; 862 863 case T_SESS: 864 size += (par->val.nval[i]) ? 6 : 9; 865 break; 866 867 default: 868 /* We should't be here... */ 869 DEBOUT(("Invalid type %d in parameter_size!\n", 870 entries[par->key].val)); 871 break; 872 } 873 if ((i + 1) < par->list_num) { 874 size++; 875 } 876 } 877 878 return size; 879 } 880 881 882 /* 883 * total_size: 884 * Determine the size of a negotiation data block 885 * 886 * Parameter: 887 * pars The parameter descriptor array 888 * n The number of elements 889 * 890 * Returns: The size of the block 891 */ 892 893 static __inline int 894 total_size(negotiation_parameter_t *pars, int n) 895 { 896 int i, size; 897 898 for (i = 0, size = 0; i < n; i++) { 899 size += parameter_size(pars++); 900 } 901 return size; 902 } 903 904 /*****************************************************************************/ 905 906 907 /* 908 * complete_pars: 909 * Allocate space for text parameters, translate parameter values into 910 * text. 911 * 912 * Parameter: 913 * state Negotiation state 914 * pdu The transmit PDU 915 * 916 * Returns: 0 On success 917 * > 0 (an ISCSI error code) if an error occurred. 918 */ 919 920 STATIC int 921 complete_pars(negotiation_state_t *state, pdu_t *pdu) 922 { 923 int len; 924 uint8_t *bp; 925 #ifdef ISCSI_TEST_MODE 926 test_pars_t *tp = pdu->connection->test_pars; 927 neg_desc_t *nd = NULL; 928 #endif 929 930 len = total_size(state->pars, state->num_pars); 931 932 #ifdef ISCSI_TEST_MODE 933 if (tp != NULL) { 934 while ((nd = TAILQ_FIRST(&pdu->connection->test_pars->negs)) != NULL && 935 nd->entry.state < state->auth_state) { 936 TAILQ_REMOVE(&tp->negs, nd, link); 937 free(nd, M_TEMP); 938 } 939 if (nd != NULL && nd->entry.state == state->auth_state) { 940 if (nd->entry.flags & ISCSITEST_NEGOPT_REPLACE) 941 len = 0; 942 len += nd->entry.size; 943 } else 944 nd = NULL; 945 } 946 #endif 947 948 DEB(10, ("complete_pars: n=%d, len=%d\n", state->num_pars, len)); 949 950 if ((bp = malloc(len, M_TEMP, M_WAITOK)) == NULL) { 951 DEBOUT(("*** Out of memory in complete_pars\n")); 952 return ISCSI_STATUS_NO_RESOURCES; 953 } 954 pdu->temp_data = bp; 955 956 #ifdef ISCSI_TEST_MODE 957 if (nd == NULL || !(nd->entry.flags & ISCSITEST_NEGOPT_REPLACE)) 958 if ((bp = put_par_block(pdu->temp_data, len, 959 state->pars, state->num_pars)) == NULL) { 960 DEBOUT(("Bad parameter in complete_pars\n")); 961 return ISCSI_STATUS_PARAMETER_INVALID; 962 } 963 if (nd != NULL) { 964 memcpy(bp, nd->entry.value, nd->entry.size); 965 TAILQ_REMOVE(&tp->negs, nd, link); 966 free(nd, M_TEMP); 967 } 968 #else 969 if (put_par_block(pdu->temp_data, len, state->pars, 970 state->num_pars) == 0) { 971 DEBOUT(("Bad parameter in complete_pars\n")); 972 return ISCSI_STATUS_PARAMETER_INVALID; 973 } 974 #endif 975 976 pdu->temp_data_len = len; 977 return 0; 978 } 979 980 981 /* 982 * set_key_n: 983 * Initialize a key and its numeric value. 984 * 985 * Parameter: 986 * state Negotiation state 987 * key The key 988 * val The value 989 */ 990 991 STATIC negotiation_parameter_t * 992 set_key_n(negotiation_state_t *state, text_key_t key, uint32_t val) 993 { 994 negotiation_parameter_t *par; 995 996 if (state->num_pars >= MAX_NEG) { 997 DEBOUT(("set_key_n: num_pars (%d) >= MAX_NEG (%d)\n", 998 state->num_pars, MAX_NEG)); 999 return NULL; 1000 } 1001 par = &state->pars[state->num_pars]; 1002 par->key = key; 1003 par->list_num = 1; 1004 par->val.nval[0] = val; 1005 state->num_pars++; 1006 state->kflags[key] |= NS_SENT; 1007 1008 return par; 1009 } 1010 1011 /* 1012 * set_key_s: 1013 * Initialize a key and its string value. 1014 * 1015 * Parameter: 1016 * state Negotiation state 1017 * key The key 1018 * val The value 1019 */ 1020 1021 STATIC negotiation_parameter_t * 1022 set_key_s(negotiation_state_t *state, text_key_t key, uint8_t *val) 1023 { 1024 negotiation_parameter_t *par; 1025 1026 if (state->num_pars >= MAX_NEG) { 1027 DEBOUT(("set_key_s: num_pars (%d) >= MAX_NEG (%d)\n", 1028 state->num_pars, MAX_NEG)); 1029 return NULL; 1030 } 1031 par = &state->pars[state->num_pars]; 1032 par->key = key; 1033 par->list_num = 1; 1034 par->val.sval = val; 1035 state->num_pars++; 1036 state->kflags[key] |= NS_SENT; 1037 1038 return par; 1039 } 1040 1041 1042 /*****************************************************************************/ 1043 1044 /* 1045 * eval_parameter: 1046 * Evaluate a received negotiation value. 1047 * 1048 * Parameter: 1049 * conn The connection 1050 * state The negotiation state 1051 * par The parameter 1052 * 1053 * Returns: 0 on success, else an ISCSI status value. 1054 */ 1055 1056 STATIC int 1057 eval_parameter(connection_t *conn, negotiation_state_t *state, 1058 negotiation_parameter_t *par) 1059 { 1060 uint32_t n = par->val.nval[0]; 1061 size_t sz; 1062 text_key_t key = par->key; 1063 bool sent = (state->kflags[key] & NS_SENT) != 0; 1064 1065 state->kflags[key] |= NS_RECEIVED; 1066 1067 switch (key) { 1068 /* 1069 * keys connected to security negotiation 1070 */ 1071 case K_AuthMethod: 1072 if (n) { 1073 DEBOUT(("eval_par: AuthMethod nonzero (%d)\n", n)); 1074 return ISCSI_STATUS_NEGOTIATION_ERROR; 1075 } 1076 break; 1077 1078 case K_Auth_CHAP_Algorithm: 1079 case K_Auth_CHAP_Challenge: 1080 case K_Auth_CHAP_Identifier: 1081 case K_Auth_CHAP_Name: 1082 case K_Auth_CHAP_Response: 1083 DEBOUT(("eval_par: Authorization Key in Operational Phase\n")); 1084 return ISCSI_STATUS_NEGOTIATION_ERROR; 1085 1086 /* 1087 * keys we always send 1088 */ 1089 case K_DataDigest: 1090 state->DataDigest = n; 1091 if (!sent) 1092 set_key_n(state, key, n); 1093 break; 1094 1095 case K_HeaderDigest: 1096 state->HeaderDigest = n; 1097 if (!sent) 1098 set_key_n(state, key, n); 1099 break; 1100 1101 case K_ErrorRecoveryLevel: 1102 state->ErrorRecoveryLevel = n; 1103 if (!sent) 1104 set_key_n(state, key, n); 1105 break; 1106 1107 case K_ImmediateData: 1108 state->ImmediateData = n; 1109 if (!sent) 1110 set_key_n(state, key, n); 1111 break; 1112 1113 case K_InitialR2T: 1114 state->InitialR2T = n; 1115 if (!sent) 1116 set_key_n(state, key, n); 1117 break; 1118 1119 case K_MaxRecvDataSegmentLength: 1120 state->MaxRecvDataSegmentLength = n; 1121 /* this is basically declarative, not negotiated */ 1122 /* (each side has its own value) */ 1123 break; 1124 1125 /* 1126 * keys we don't always send, so we may have to reflect the value 1127 */ 1128 case K_DefaultTime2Retain: 1129 state->DefaultTime2Retain = n = min(state->DefaultTime2Retain, n); 1130 if (!sent) 1131 set_key_n(state, key, n); 1132 break; 1133 1134 case K_DefaultTime2Wait: 1135 state->DefaultTime2Wait = n = min(state->DefaultTime2Wait, n); 1136 if (!sent) 1137 set_key_n(state, key, n); 1138 break; 1139 1140 case K_MaxConnections: 1141 if (state->MaxConnections) 1142 state->MaxConnections = n = min(state->MaxConnections, n); 1143 else 1144 state->MaxConnections = n; 1145 1146 if (!sent) 1147 set_key_n(state, key, n); 1148 break; 1149 1150 case K_MaxOutstandingR2T: 1151 state->MaxOutstandingR2T = n; 1152 if (!sent) 1153 set_key_n(state, key, n); 1154 break; 1155 1156 case K_FirstBurstLength: 1157 state->FirstBurstLength = n; 1158 if (!sent) 1159 set_key_n(state, key, n); 1160 break; 1161 1162 case K_MaxBurstLength: 1163 state->MaxBurstLength = n; 1164 if (!sent) 1165 set_key_n(state, key, n); 1166 break; 1167 1168 case K_IFMarker: 1169 case K_OFMarker: 1170 /* not (yet) supported */ 1171 if (!sent) 1172 set_key_n(state, key, 0); 1173 break; 1174 1175 case K_IFMarkInt: 1176 case K_OFMarkInt: 1177 /* it's a range, and list_num will be 1, so this will reply "Reject" */ 1178 if (!sent) 1179 set_key_n(state, key, 0); 1180 break; 1181 1182 case K_DataPDUInOrder: 1183 case K_DataSequenceInOrder: 1184 /* values are don't care */ 1185 if (!sent) 1186 set_key_n(state, key, n); 1187 break; 1188 1189 case K_NotUnderstood: 1190 /* return "NotUnderstood" */ 1191 set_key_s(state, key, par->val.sval); 1192 break; 1193 1194 /* 1195 * Declarative keys (no response required) 1196 */ 1197 case K_TargetAddress: 1198 /* ignore for now... */ 1199 break; 1200 1201 case K_TargetAlias: 1202 if (conn->login_par->is_present.TargetAlias) { 1203 copyoutstr(par->val.sval, conn->login_par->TargetAlias, 1204 ISCSI_STRING_LENGTH - 1, &sz); 1205 /* do anything with return code?? */ 1206 } 1207 break; 1208 1209 case K_TargetPortalGroupTag: 1210 /* ignore for now... */ 1211 break; 1212 1213 default: 1214 DEBOUT(("eval_par: Invalid parameter type %d\n", par->key)); 1215 return ISCSI_STATUS_NEGOTIATION_ERROR; 1216 } 1217 return 0; 1218 } 1219 1220 /*****************************************************************************/ 1221 1222 1223 /* 1224 * init_session_parameters: 1225 * Initialize session-related negotiation parameters from existing session 1226 * 1227 * Parameter: 1228 * sess The session 1229 * state The negotiation state 1230 */ 1231 1232 STATIC void 1233 init_session_parameters(session_t *sess, negotiation_state_t *state) 1234 { 1235 1236 state->ErrorRecoveryLevel = sess->ErrorRecoveryLevel; 1237 state->InitialR2T = sess->InitialR2T; 1238 state->ImmediateData = sess->ImmediateData; 1239 state->MaxConnections = sess->MaxConnections; 1240 state->DefaultTime2Wait = sess->DefaultTime2Wait; 1241 state->DefaultTime2Retain = sess->DefaultTime2Retain; 1242 state->MaxBurstLength = sess->MaxBurstLength; 1243 state->FirstBurstLength = sess->FirstBurstLength; 1244 state->MaxOutstandingR2T = sess->MaxOutstandingR2T; 1245 } 1246 1247 1248 1249 /* 1250 * assemble_login_parameters: 1251 * Assemble the initial login negotiation parameters. 1252 * 1253 * Parameter: 1254 * conn The connection 1255 * ccb The CCB for the login exchange 1256 * pdu The PDU to use for sending 1257 * 1258 * Returns: < 0 if more security negotiation is required 1259 * 0 if this is the last security negotiation block 1260 * > 0 (an ISCSI error code) if an error occurred. 1261 */ 1262 1263 int 1264 assemble_login_parameters(connection_t *conn, ccb_t *ccb, pdu_t *pdu) 1265 { 1266 iscsi_login_parameters_t *par = conn->login_par; 1267 size_t sz; 1268 int rc, i, next; 1269 negotiation_state_t *state; 1270 negotiation_parameter_t *cpar; 1271 1272 state = malloc(sizeof(*state), M_TEMP, M_WAITOK | M_ZERO); 1273 if (state == NULL) { 1274 DEBOUT(("*** Out of memory in assemble_login_params\n")); 1275 return ISCSI_STATUS_NO_RESOURCES; 1276 } 1277 ccb->temp_data = state; 1278 1279 if (!iscsi_InitiatorName[0]) { 1280 DEBOUT(("No InitiatorName\n")); 1281 return ISCSI_STATUS_PARAMETER_MISSING; 1282 } 1283 set_key_s(state, K_InitiatorName, iscsi_InitiatorName); 1284 1285 if (iscsi_InitiatorAlias[0]) 1286 set_key_s(state, K_InitiatorAlias, iscsi_InitiatorAlias); 1287 1288 conn->Our_MaxRecvDataSegmentLength = 1289 (par->is_present.MaxRecvDataSegmentLength) 1290 ? par->MaxRecvDataSegmentLength : DEFAULT_MaxRecvDataSegmentLength; 1291 1292 /* setup some values for authentication */ 1293 if (par->is_present.password) 1294 copyinstr(par->password, state->password, MAX_STRING, &sz); 1295 if (par->is_present.target_password) 1296 copyinstr(par->target_password, state->target_password, 1297 MAX_STRING, &sz); 1298 if (par->is_present.user_name) 1299 copyinstr(par->user_name, state->user_name, MAX_STRING, &sz); 1300 else 1301 strlcpy(state->user_name, iscsi_InitiatorName, 1302 sizeof(state->user_name)); 1303 1304 next = TRUE; 1305 1306 set_key_n(state, K_SessionType, 1307 par->login_type > ISCSI_LOGINTYPE_DISCOVERY); 1308 1309 cpar = set_key_n(state, K_AuthMethod, ISCSI_AUTH_None); 1310 1311 if (cpar != NULL && par->is_present.auth_info && 1312 par->auth_info.auth_number > 0) { 1313 if (par->auth_info.auth_number > ISCSI_AUTH_OPTIONS) { 1314 DEBOUT(("Auth number too big in asm_login\n")); 1315 return ISCSI_STATUS_PARAMETER_INVALID; 1316 } 1317 cpar->list_num = par->auth_info.auth_number; 1318 for (i = 0; i < cpar->list_num; i++) { 1319 cpar->val.nval[i] = par->auth_info.auth_type[i]; 1320 if (par->auth_info.auth_type[i]) 1321 next = FALSE; 1322 } 1323 } 1324 1325 if (par->is_present.TargetName) 1326 copyinstr(par->TargetName, state->temp_buf, ISCSI_STRING_LENGTH - 1, 1327 &sz); 1328 else { 1329 state->temp_buf[0] = 0; 1330 sz = 0; 1331 } 1332 1333 if ((!sz || !state->temp_buf[0]) && 1334 par->login_type != ISCSI_LOGINTYPE_DISCOVERY) { 1335 DEBOUT(("No TargetName\n")); 1336 return ISCSI_STATUS_PARAMETER_MISSING; 1337 } 1338 1339 if (state->temp_buf[0]) { 1340 set_key_s(state, K_TargetName, state->temp_buf); 1341 } 1342 1343 if ((rc = complete_pars(state, pdu)) != 0) 1344 return rc; 1345 1346 return (next) ? 0 : -1; 1347 } 1348 1349 1350 /* 1351 * assemble_security_parameters: 1352 * Assemble the security negotiation parameters. 1353 * 1354 * Parameter: 1355 * conn The connection 1356 * rx_pdu The received login response PDU 1357 * tx_pdu The transmit PDU 1358 * 1359 * Returns: < 0 if more security negotiation is required 1360 * 0 if this is the last security negotiation block 1361 * > 0 (an ISCSI error code) if an error occurred. 1362 */ 1363 1364 int 1365 assemble_security_parameters(connection_t *conn, ccb_t *ccb, pdu_t *rx_pdu, 1366 pdu_t *tx_pdu) 1367 { 1368 negotiation_state_t *state = (negotiation_state_t *) ccb->temp_data; 1369 iscsi_login_parameters_t *par = conn->login_par; 1370 negotiation_parameter_t rxp, *cpar; 1371 uint8_t *rxpars; 1372 int rc, next; 1373 uint8_t identifier = 0; 1374 uint8_t *challenge = NULL; 1375 int challenge_size = 0; 1376 uint8_t *response = NULL; 1377 int response_size = 0; 1378 1379 state->num_pars = 0; 1380 next = 0; 1381 1382 rxpars = (uint8_t *) rx_pdu->temp_data; 1383 if (rxpars == NULL) { 1384 DEBOUT(("No received parameters!\n")); 1385 return ISCSI_STATUS_NEGOTIATION_ERROR; 1386 } 1387 /* Note: There are always at least 2 extra bytes past temp_data_len */ 1388 rxpars[rx_pdu->temp_data_len] = '\0'; 1389 rxpars[rx_pdu->temp_data_len + 1] = '\0'; 1390 1391 while (*rxpars) { 1392 if ((rxpars = get_parameter(rxpars, &rxp)) == NULL) { 1393 DEBOUT(("get_parameter returned error\n")); 1394 return ISCSI_STATUS_NEGOTIATION_ERROR; 1395 } 1396 1397 state->kflags[rxp.key] |= NS_RECEIVED; 1398 1399 switch (rxp.key) { 1400 case K_AuthMethod: 1401 if (state->auth_state != AUTH_INITIAL) { 1402 DEBOUT(("AuthMethod received, auth_state = %d\n", 1403 state->auth_state)); 1404 return ISCSI_STATUS_NEGOTIATION_ERROR; 1405 } 1406 1407 /* Note: if the selection is None, we shouldn't be here, 1408 * the target should have transited the state to op-neg. 1409 */ 1410 if (rxp.val.nval[0] != ISCSI_AUTH_CHAP) { 1411 DEBOUT(("AuthMethod isn't CHAP (%d)\n", rxp.val.nval[0])); 1412 return ISCSI_STATUS_NEGOTIATION_ERROR; 1413 } 1414 1415 state->auth_state = AUTH_METHOD_SELECTED; 1416 state->auth_alg = rxp.val.nval[0]; 1417 break; 1418 1419 case K_Auth_CHAP_Algorithm: 1420 if (state->auth_state != AUTH_CHAP_ALG_SENT || 1421 rxp.val.nval[0] != 5) { 1422 DEBOUT(("Bad algorithm, auth_state = %d, alg %d\n", 1423 state->auth_state, rxp.val.nval[0])); 1424 return ISCSI_STATUS_NEGOTIATION_ERROR; 1425 } 1426 break; 1427 1428 case K_Auth_CHAP_Challenge: 1429 if (state->auth_state != AUTH_CHAP_ALG_SENT || !rxp.list_num) { 1430 DEBOUT(("Bad Challenge, auth_state = %d, len %d\n", 1431 state->auth_state, rxp.list_num)); 1432 return ISCSI_STATUS_NEGOTIATION_ERROR; 1433 } 1434 challenge = rxp.val.sval; 1435 challenge_size = rxp.list_num; 1436 break; 1437 1438 case K_Auth_CHAP_Identifier: 1439 if (state->auth_state != AUTH_CHAP_ALG_SENT) { 1440 DEBOUT(("Bad ID, auth_state = %d, id %d\n", 1441 state->auth_state, rxp.val.nval[0])); 1442 return ISCSI_STATUS_NEGOTIATION_ERROR; 1443 } 1444 identifier = (uint8_t) rxp.val.nval[0]; 1445 break; 1446 1447 case K_Auth_CHAP_Name: 1448 if (state->auth_state != AUTH_CHAP_RSP_SENT) { 1449 DEBOUT(("Bad Name, auth_state = %d, name <%s>\n", 1450 state->auth_state, rxp.val.sval)); 1451 return ISCSI_STATUS_NEGOTIATION_ERROR; 1452 } 1453 /* what do we do with the name?? */ 1454 break; 1455 1456 case K_Auth_CHAP_Response: 1457 if (state->auth_state != AUTH_CHAP_RSP_SENT) { 1458 DEBOUT(("Bad Response, auth_state = %d, size %d\n", 1459 state->auth_state, rxp.list_num)); 1460 return ISCSI_STATUS_NEGOTIATION_ERROR; 1461 } 1462 response = rxp.val.sval; 1463 response_size = rxp.list_num; 1464 if (response_size != CHAP_MD5_SIZE) 1465 return ISCSI_STATUS_NEGOTIATION_ERROR; 1466 break; 1467 1468 default: 1469 rc = eval_parameter(conn, state, &rxp); 1470 if (rc) 1471 return rc; 1472 break; 1473 } 1474 } 1475 1476 switch (state->auth_state) { 1477 case AUTH_INITIAL: 1478 DEBOUT(("Didn't receive Method\n")); 1479 return ISCSI_STATUS_NEGOTIATION_ERROR; 1480 1481 case AUTH_METHOD_SELECTED: 1482 set_key_n(state, K_Auth_CHAP_Algorithm, 5); 1483 state->auth_state = AUTH_CHAP_ALG_SENT; 1484 next = -1; 1485 break; 1486 1487 case AUTH_CHAP_ALG_SENT: 1488 if (!RX(state, K_Auth_CHAP_Algorithm) || 1489 !RX(state, K_Auth_CHAP_Identifier) || 1490 !RX(state, K_Auth_CHAP_Challenge)) { 1491 DEBOUT(("Didn't receive all parameters\n")); 1492 return ISCSI_STATUS_NEGOTIATION_ERROR; 1493 } 1494 1495 set_key_s(state, K_Auth_CHAP_Name, state->user_name); 1496 1497 chap_md5_response(state->temp_buf, identifier, state->password, 1498 challenge, challenge_size); 1499 1500 cpar = set_key_s(state, K_Auth_CHAP_Response, state->temp_buf); 1501 if (cpar != NULL) 1502 cpar->list_num = CHAP_MD5_SIZE; 1503 1504 if (par->auth_info.mutual_auth) { 1505 if (!state->target_password[0]) { 1506 DEBOUT(("No target password with mutual authentication!\n")); 1507 return ISCSI_STATUS_PARAMETER_MISSING; 1508 } 1509 1510 cprng_strong(kern_cprng, 1511 &state->temp_buf[CHAP_MD5_SIZE], 1512 CHAP_CHALLENGE_LEN + 1, 0); 1513 set_key_n(state, K_Auth_CHAP_Identifier, 1514 state->temp_buf[CHAP_MD5_SIZE]); 1515 cpar = set_key_s(state, K_Auth_CHAP_Challenge, 1516 &state->temp_buf[CHAP_MD5_SIZE + 1]); 1517 if (cpar != NULL) 1518 cpar->list_num = CHAP_CHALLENGE_LEN; 1519 next = -1; 1520 } 1521 state->auth_state = AUTH_CHAP_RSP_SENT; 1522 break; 1523 1524 case AUTH_CHAP_RSP_SENT: 1525 /* we can only be here for mutual authentication */ 1526 if (!par->auth_info.mutual_auth || response == NULL) { 1527 DEBOUT(("Mutual authentication not requested\n")); 1528 return ISCSI_STATUS_NEGOTIATION_ERROR; 1529 } 1530 1531 chap_md5_response(state->temp_buf, 1532 state->temp_buf[CHAP_MD5_SIZE], 1533 state->password, 1534 &state->temp_buf[CHAP_MD5_SIZE + 1], 1535 CHAP_CHALLENGE_LEN); 1536 1537 if (memcmp(state->temp_buf, response, response_size)) { 1538 DEBOUT(("Mutual authentication mismatch\n")); 1539 return ISCSI_STATUS_AUTHENTICATION_FAILED; 1540 } 1541 break; 1542 1543 default: 1544 break; 1545 } 1546 1547 complete_pars(state, tx_pdu); 1548 1549 return next; 1550 } 1551 1552 1553 /* 1554 * set_first_opnegs: 1555 * Set the operational negotiation parameters we want to negotiate in 1556 * the first login request in op_neg phase. 1557 * 1558 * Parameter: 1559 * conn The connection 1560 * state Negotiation state 1561 */ 1562 1563 STATIC void 1564 set_first_opnegs(connection_t *conn, negotiation_state_t *state) 1565 { 1566 iscsi_login_parameters_t *lpar = conn->login_par; 1567 negotiation_parameter_t *cpar; 1568 1569 /* Digests - suggest None,CRC32C unless the user forces a value */ 1570 cpar = set_key_n(state, K_HeaderDigest, 1571 (lpar->is_present.HeaderDigest) ? lpar->HeaderDigest : 0); 1572 if (cpar != NULL && !lpar->is_present.HeaderDigest) { 1573 cpar->list_num = 2; 1574 cpar->val.nval[1] = 1; 1575 } 1576 1577 cpar = set_key_n(state, K_DataDigest, (lpar->is_present.DataDigest) 1578 ? lpar->DataDigest : 0); 1579 if (cpar != NULL && !lpar->is_present.DataDigest) { 1580 cpar->list_num = 2; 1581 cpar->val.nval[1] = 1; 1582 } 1583 1584 set_key_n(state, K_MaxRecvDataSegmentLength, 1585 conn->Our_MaxRecvDataSegmentLength); 1586 /* This is direction-specific, we may have a different default */ 1587 state->MaxRecvDataSegmentLength = 1588 entries[K_MaxRecvDataSegmentLength].defval; 1589 1590 /* First connection only */ 1591 if (!conn->session->TSIH) { 1592 state->ErrorRecoveryLevel = 1593 (lpar->is_present.ErrorRecoveryLevel) ? lpar->ErrorRecoveryLevel 1594 : 2; 1595 /* 1596 Negotiate InitialR2T to FALSE and ImmediateData to TRUE, should 1597 be slightly more efficient than the default InitialR2T=TRUE. 1598 */ 1599 state->InitialR2T = FALSE; 1600 state->ImmediateData = TRUE; 1601 1602 /* We don't really care about this, so don't negotiate by default */ 1603 state->MaxBurstLength = entries[K_MaxBurstLength].defval; 1604 state->FirstBurstLength = entries[K_FirstBurstLength].defval; 1605 state->MaxOutstandingR2T = entries[K_MaxOutstandingR2T].defval; 1606 1607 #ifdef ISCSI_TEST_MODE 1608 if (conn->test_pars != NULL) { 1609 test_pars_t *tp = conn->test_pars; 1610 1611 if (tp->options & ISCSITEST_OVERRIDE_INITIALR2T) 1612 state->InitialR2T = TRUE; 1613 if (tp->options & ISCSITEST_OVERRIDE_IMMDATA) 1614 state->ImmediateData = FALSE; 1615 1616 if (tp->options & ISCSITEST_NEGOTIATE_MAXBURST) { 1617 state->MaxBurstLength = tp->maxburst_val; 1618 set_key_n(state, K_MaxBurstLength, state->MaxBurstLength); 1619 } 1620 if (tp->options & ISCSITEST_NEGOTIATE_FIRSTBURST) { 1621 state->FirstBurstLength = tp->firstburst_val; 1622 set_key_n(state, K_FirstBurstLength, state->FirstBurstLength); 1623 } 1624 if (tp->options & ISCSITEST_NEGOTIATE_R2T) { 1625 state->MaxOutstandingR2T = tp->r2t_val; 1626 set_key_n(state, K_MaxOutstandingR2T, state->MaxOutstandingR2T); 1627 } 1628 } 1629 #endif 1630 1631 set_key_n(state, K_ErrorRecoveryLevel, state->ErrorRecoveryLevel); 1632 set_key_n(state, K_InitialR2T, state->InitialR2T); 1633 set_key_n(state, K_ImmediateData, state->ImmediateData); 1634 1635 if (lpar->is_present.MaxConnections) { 1636 state->MaxConnections = lpar->MaxConnections; 1637 set_key_n(state, K_MaxConnections, lpar->MaxConnections); 1638 } 1639 1640 if (lpar->is_present.DefaultTime2Wait) 1641 set_key_n(state, K_DefaultTime2Wait, lpar->DefaultTime2Wait); 1642 else 1643 state->DefaultTime2Wait = entries[K_DefaultTime2Wait].defval; 1644 1645 if (lpar->is_present.DefaultTime2Retain) 1646 set_key_n(state, K_DefaultTime2Retain, lpar->DefaultTime2Retain); 1647 else 1648 state->DefaultTime2Retain = entries[K_DefaultTime2Retain].defval; 1649 } else 1650 init_session_parameters(conn->session, state); 1651 1652 DEBC(conn, 10, ("SetFirstOpnegs: recover=%d, MRDSL=%d\n", 1653 conn->recover, state->MaxRecvDataSegmentLength)); 1654 } 1655 1656 1657 /* 1658 * assemble_negotiation_parameters: 1659 * Assemble any negotiation parameters requested by the other side. 1660 * 1661 * Parameter: 1662 * conn The connection 1663 * ccb The login ccb 1664 * rx_pdu The received login response PDU 1665 * tx_pdu The transmit PDU 1666 * 1667 * Returns: 0 On success 1668 * > 0 (an ISCSI error code) if an error occurred. 1669 */ 1670 1671 int 1672 assemble_negotiation_parameters(connection_t *conn, ccb_t *ccb, pdu_t *rx_pdu, 1673 pdu_t *tx_pdu) 1674 { 1675 negotiation_state_t *state = (negotiation_state_t *) ccb->temp_data; 1676 negotiation_parameter_t rxp; 1677 uint8_t *rxpars; 1678 int rc; 1679 1680 state->num_pars = 0; 1681 1682 DEBC(conn, 10, ("AsmNegParams: connState=%d, MRDSL=%d\n", 1683 conn->state, state->MaxRecvDataSegmentLength)); 1684 1685 if (conn->state == ST_SEC_NEG) { 1686 conn->state = ST_OP_NEG; 1687 set_first_opnegs(conn, state); 1688 } 1689 1690 rxpars = (uint8_t *) rx_pdu->temp_data; 1691 if (rxpars != NULL) { 1692 /* Note: There are always at least 2 extra bytes past temp_data_len */ 1693 rxpars[rx_pdu->temp_data_len] = '\0'; 1694 rxpars[rx_pdu->temp_data_len + 1] = '\0'; 1695 1696 while (*rxpars) { 1697 if ((rxpars = get_parameter(rxpars, &rxp)) == NULL) 1698 return ISCSI_STATUS_NEGOTIATION_ERROR; 1699 1700 rc = eval_parameter(conn, state, &rxp); 1701 if (rc) 1702 return rc; 1703 } 1704 } 1705 1706 if (tx_pdu == NULL) 1707 return 0; 1708 1709 complete_pars(state, tx_pdu); 1710 1711 return 0; 1712 } 1713 1714 /* 1715 * init_text_parameters: 1716 * Initialize text negotiation. 1717 * 1718 * Parameter: 1719 * conn The connection 1720 * tx_pdu The transmit PDU 1721 * 1722 * Returns: 0 On success 1723 * > 0 (an ISCSI error code) if an error occurred. 1724 */ 1725 1726 int 1727 init_text_parameters(connection_t *conn, ccb_t *ccb) 1728 { 1729 negotiation_state_t *state; 1730 1731 state = malloc(sizeof(*state), M_TEMP, M_WAITOK | M_ZERO); 1732 if (state == NULL) { 1733 DEBOUT(("*** Out of memory in init_text_params\n")); 1734 return ISCSI_STATUS_NO_RESOURCES; 1735 } 1736 ccb->temp_data = state; 1737 1738 state->HeaderDigest = conn->HeaderDigest; 1739 state->DataDigest = conn->DataDigest; 1740 state->MaxRecvDataSegmentLength = conn->MaxRecvDataSegmentLength; 1741 init_session_parameters(conn->session, state); 1742 1743 return 0; 1744 } 1745 1746 1747 /* 1748 * assemble_send_targets: 1749 * Assemble send targets request 1750 * 1751 * Parameter: 1752 * pdu The transmit PDU 1753 * val The SendTargets key value 1754 * 1755 * Returns: 0 On success 1756 * > 0 (an ISCSI error code) if an error occurred. 1757 */ 1758 1759 int 1760 assemble_send_targets(pdu_t *pdu, uint8_t *val) 1761 { 1762 negotiation_parameter_t par; 1763 uint8_t *buf; 1764 int len; 1765 1766 par.key = K_SendTargets; 1767 par.list_num = 1; 1768 par.val.sval = val; 1769 1770 len = parameter_size(&par); 1771 1772 if ((buf = malloc(len, M_TEMP, M_WAITOK)) == NULL) { 1773 DEBOUT(("*** Out of memory in assemble_send_targets\n")); 1774 return ISCSI_STATUS_NO_RESOURCES; 1775 } 1776 pdu->temp_data = buf; 1777 pdu->temp_data_len = len; 1778 1779 if (put_parameter(buf, len, &par) == 0) 1780 return ISCSI_STATUS_PARAMETER_INVALID; 1781 1782 return 0; 1783 } 1784 1785 1786 /* 1787 * set_negotiated_parameters: 1788 * Copy the negotiated parameters into the connection and session structure. 1789 * 1790 * Parameter: 1791 * ccb The ccb containing the state information 1792 */ 1793 1794 void 1795 set_negotiated_parameters(ccb_t *ccb) 1796 { 1797 negotiation_state_t *state = (negotiation_state_t *) ccb->temp_data; 1798 connection_t *conn = ccb->connection; 1799 session_t *sess = ccb->session; 1800 1801 conn->HeaderDigest = state->HeaderDigest; 1802 conn->DataDigest = state->DataDigest; 1803 sess->ErrorRecoveryLevel = state->ErrorRecoveryLevel; 1804 sess->InitialR2T = state->InitialR2T; 1805 sess->ImmediateData = state->ImmediateData; 1806 conn->MaxRecvDataSegmentLength = state->MaxRecvDataSegmentLength; 1807 sess->MaxConnections = state->MaxConnections; 1808 sess->DefaultTime2Wait = conn->Time2Wait = state->DefaultTime2Wait; 1809 sess->DefaultTime2Retain = conn->Time2Retain = 1810 state->DefaultTime2Retain; 1811 1812 /* set idle connection timeout to half the Time2Retain window so we */ 1813 /* don't miss it, unless Time2Retain is ridiculously small. */ 1814 conn->idle_timeout_val = (conn->Time2Retain >= 10) ? 1815 (conn->Time2Retain / 2) * hz : CONNECTION_IDLE_TIMEOUT; 1816 1817 sess->MaxBurstLength = state->MaxBurstLength; 1818 sess->FirstBurstLength = state->FirstBurstLength; 1819 sess->MaxOutstandingR2T = state->MaxOutstandingR2T; 1820 1821 DEBC(conn, 10,("SetNegPar: MRDSL=%d, MBL=%d, FBL=%d, IR2T=%d, ImD=%d\n", 1822 state->MaxRecvDataSegmentLength, state->MaxBurstLength, 1823 state->FirstBurstLength, state->InitialR2T, 1824 state->ImmediateData)); 1825 1826 conn->max_transfer = min(sess->MaxBurstLength, conn->MaxRecvDataSegmentLength); 1827 1828 conn->max_firstimmed = (!sess->ImmediateData) ? 0 : 1829 min(sess->FirstBurstLength, conn->max_transfer); 1830 1831 conn->max_firstdata = (sess->InitialR2T || sess->FirstBurstLength < conn->max_firstimmed) ? 0 : 1832 min(sess->FirstBurstLength - conn->max_firstimmed, conn->max_transfer); 1833 1834 } 1835