From 041c4328fe6735bbf64b115442ed0fbe88344d14 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 17 Jun 2014 16:40:36 -0700 Subject: [PATCH] 3.14-stable patches added patches: iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch --- ...authentication-with-reflected-chap_c.patch | 47 +++++++++++++++++++ queue-3.14/series | 1 + 2 files changed, 48 insertions(+) create mode 100644 queue-3.14/iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch diff --git a/queue-3.14/iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch b/queue-3.14/iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch new file mode 100644 index 00000000000..469276e7d3d --- /dev/null +++ b/queue-3.14/iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch @@ -0,0 +1,47 @@ +From 1d2b60a5545942b1376cb48c1d55843d71e3a08f Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Thu, 5 Jun 2014 18:08:57 -0700 +Subject: iscsi-target: Reject mutual authentication with reflected CHAP_C + +From: Nicholas Bellinger + +commit 1d2b60a5545942b1376cb48c1d55843d71e3a08f upstream. + +This patch adds an explicit check in chap_server_compute_md5() to ensure +the CHAP_C value received from the initiator during mutual authentication +does not match the original CHAP_C provided by the target. + +This is in line with RFC-3720, section 8.2.1: + + Originators MUST NOT reuse the CHAP challenge sent by the Responder + for the other direction of a bidirectional authentication. + Responders MUST check for this condition and close the iSCSI TCP + connection if it occurs. + +Reported-by: Tejas Vaykole +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target_auth.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/target/iscsi/iscsi_target_auth.c ++++ b/drivers/target/iscsi/iscsi_target_auth.c +@@ -314,6 +314,16 @@ static int chap_server_compute_md5( + goto out; + } + /* ++ * During mutual authentication, the CHAP_C generated by the ++ * initiator must not match the original CHAP_C generated by ++ * the target. ++ */ ++ if (!memcmp(challenge_binhex, chap->challenge, CHAP_CHALLENGE_LENGTH)) { ++ pr_err("initiator CHAP_C matches target CHAP_C, failing" ++ " login attempt\n"); ++ goto out; ++ } ++ /* + * Generate CHAP_N and CHAP_R for mutual authentication. + */ + tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC); diff --git a/queue-3.14/series b/queue-3.14/series index 7cec2665cee..572bda16da8 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -1,2 +1,3 @@ rtc-rtc-at91rm9200-fix-infinite-wait-for-ackupd-irq.patch target-fix-null-pointer-dereference-for-xcopy-in-target_put_sess_cmd.patch +iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch -- 2.47.3