NetworkPkg: introduce the NETWORK_ISCSI_MD5_ENABLE feature test macro

Introduce the NETWORK_ISCSI_MD5_ENABLE feature test macro for NetworkPkg.
When explicitly set to FALSE, remove MD5 from IScsiDxe's CHAP algorithm
list.

Set NETWORK_ISCSI_MD5_ENABLE to TRUE by default, for compatibility
reasons. Not just to minimize the disruption for platforms that currently
include IScsiDxe, but also because RFC 7143 mandates MD5 for CHAP, and
some vendors' iSCSI targets support MD5 only.

With MD5 enabled, IScsiDxe will suggest SHA256, and then fall back to MD5
if the target requests it. With MD5 disabled, IScsiDxe will suggest
SHA256, and break off the connection (and session) if the target doesn't
support SHA256.

Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3355
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20210629163337.14120-7-lersek@redhat.com>

3 files changed, 23 insertions, 1 deletions

diff --git a/NetworkPkg/IScsiDxe/IScsiCHAP.c b/NetworkPkg/IScsiDxe/IScsiCHAP.c
index 80035ec..0491ef4 100644
--- a/NetworkPkg/IScsiDxe/IScsiCHAP.c
+++ b/NetworkPkg/IScsiDxe/IScsiCHAP.c
@@ -23,6 +23,7 @@ STATIC CONST CHAP_HASH mChapHash[] = {
     Sha256Update,

     Sha256Final

   },

+#ifdef ENABLE_MD5_DEPRECATED_INTERFACES

   //

   // Keep the deprecated MD5 entry at the end of the array (making MD5 the

   // least preferred choice of the initiator).

@@ -35,6 +36,7 @@ STATIC CONST CHAP_HASH mChapHash[] = {
     Md5Update,

     Md5Final

   },

+#endif // ENABLE_MD5_DEPRECATED_INTERFACES

 };

 

 //

diff --git a/NetworkPkg/NetworkBuildOptions.dsc.inc b/NetworkPkg/NetworkBuildOptions.dsc.inc
index 42d980d..738da22 100644
--- a/NetworkPkg/NetworkBuildOptions.dsc.inc
+++ b/NetworkPkg/NetworkBuildOptions.dsc.inc
@@ -14,7 +14,7 @@
 #

 ##

 

-!if $(NETWORK_ISCSI_ENABLE) == TRUE

+!if $(NETWORK_ISCSI_ENABLE) == TRUE && $(NETWORK_ISCSI_MD5_ENABLE) == TRUE

   MSFT:*_*_*_CC_FLAGS = /D ENABLE_MD5_DEPRECATED_INTERFACES

   INTEL:*_*_*_CC_FLAGS = /D ENABLE_MD5_DEPRECATED_INTERFACES

   GCC:*_*_*_CC_FLAGS = -D ENABLE_MD5_DEPRECATED_INTERFACES

diff --git a/NetworkPkg/NetworkDefines.dsc.inc b/NetworkPkg/NetworkDefines.dsc.inc
index 54deb63..e39a9cb 100644
--- a/NetworkPkg/NetworkDefines.dsc.inc
+++ b/NetworkPkg/NetworkDefines.dsc.inc
@@ -19,6 +19,7 @@
 #   DEFINE NETWORK_HTTP_BOOT_ENABLE       = TRUE

 #   DEFINE NETWORK_ALLOW_HTTP_CONNECTIONS = FALSE

 #   DEFINE NETWORK_ISCSI_ENABLE           = FALSE

+#   DEFINE NETWORK_ISCSI_MD5_ENABLE       = TRUE

 #   DEFINE NETWORK_VLAN_ENABLE            = TRUE

 #

 # Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>

@@ -117,6 +118,25 @@
   DEFINE NETWORK_ISCSI_ENABLE = FALSE

 !endif

 

+!ifndef NETWORK_ISCSI_MD5_ENABLE

+  #

+  # This flag enables the deprecated MD5 hash algorithm in iSCSI CHAP

+  # authentication.

+  #

+  # Note: The NETWORK_ISCSI_MD5_ENABLE flag only makes a difference if

+  #       NETWORK_ISCSI_ENABLE is TRUE; otherwise, NETWORK_ISCSI_MD5_ENABLE is

+  #       ignored.

+  #

+  #       With NETWORK_ISCSI_MD5_ENABLE set to TRUE, MD5 is enabled as the

+  #       least preferred CHAP hash algorithm. With NETWORK_ISCSI_MD5_ENABLE

+  #       set to FALSE, MD5 is disabled statically, at build time.

+  #

+  #       The default value is TRUE, because RFC 7143 mandates MD5, and because

+  #       several vendors' iSCSI targets only support MD5, for CHAP.

+  #

+  DEFINE NETWORK_ISCSI_MD5_ENABLE = TRUE

+!endif

+

 !if $(NETWORK_ENABLE) == TRUE

   #

   # Check the flags to see if there is any conflict.