From: Greg Kroah-Hartman Date: Tue, 17 Jun 2014 23:40:43 +0000 (-0700) Subject: 3.4-stable patches X-Git-Tag: v3.4.95~46 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1d348d7017d04d1e6eaf1ed63ca1dfc6b631ce8f;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch --- diff --git a/queue-3.4/iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch b/queue-3.4/iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch new file mode 100644 index 00000000000..016c761f1ce --- /dev/null +++ b/queue-3.4/iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch @@ -0,0 +1,47 @@ +From 1d2b60a5545942b1376cb48c1d55843d71e3a08f Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Thu, 5 Jun 2014 18:08:57 -0700 +Subject: iscsi-target: Reject mutual authentication with reflected CHAP_C + +From: Nicholas Bellinger + +commit 1d2b60a5545942b1376cb48c1d55843d71e3a08f upstream. + +This patch adds an explicit check in chap_server_compute_md5() to ensure +the CHAP_C value received from the initiator during mutual authentication +does not match the original CHAP_C provided by the target. + +This is in line with RFC-3720, section 8.2.1: + + Originators MUST NOT reuse the CHAP challenge sent by the Responder + for the other direction of a bidirectional authentication. + Responders MUST check for this condition and close the iSCSI TCP + connection if it occurs. + +Reported-by: Tejas Vaykole +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target_auth.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/target/iscsi/iscsi_target_auth.c ++++ b/drivers/target/iscsi/iscsi_target_auth.c +@@ -342,6 +342,16 @@ static int chap_server_compute_md5( + goto out; + } + /* ++ * During mutual authentication, the CHAP_C generated by the ++ * initiator must not match the original CHAP_C generated by ++ * the target. ++ */ ++ if (!memcmp(challenge_binhex, chap->challenge, CHAP_CHALLENGE_LENGTH)) { ++ pr_err("initiator CHAP_C matches target CHAP_C, failing" ++ " login attempt\n"); ++ goto out; ++ } ++ /* + * Generate CHAP_N and CHAP_R for mutual authentication. + */ + tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC); diff --git a/queue-3.4/series b/queue-3.4/series index e69de29bb2d..a2a1404f604 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -0,0 +1 @@ +iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch