summaryrefslogtreecommitdiff
path: root/NetworkPkg/IScsiDxe/IScsiMisc.h
AgeCommit message (Collapse)AuthorFilesLines
2024-05-24NetworkPkg: SECURITY PATCH CVE-2023-45237Doug Flick1-1/+5
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4542 Bug Overview: PixieFail Bug #9 CVE-2023-45237 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Use of a Weak PseudoRandom Number Generator Change Overview: Updates all Instances of NET_RANDOM (NetRandomInitSeed ()) to either > > EFI_STATUS > EFIAPI > PseudoRandomU32 ( > OUT UINT32 *Output > ); > or (depending on the use case) > > EFI_STATUS > EFIAPI > PseudoRandom ( > OUT VOID *Output, > IN UINTN OutputLength > ); > This is because the use of Example: The following code snippet PseudoRandomU32 () function is used: > > UINT32 Random; > > Status = PseudoRandomU32 (&Random); > if (EFI_ERROR (Status)) { > DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status)); > return Status; > } > This also introduces a new PCD to enable/disable the use of the secure implementation of algorithms for PseudoRandom () and instead depend on the default implementation. This may be required for some platforms where the UEFI Spec defined algorithms are not available. > > PcdEnforceSecureRngAlgorithms > If the platform does not have any one of the UEFI defined secure RNG algorithms then the driver will assert. Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
2021-12-07NetworkPkg: Apply uncrustify changesMichael Kubacki1-48/+45
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3737 Apply uncrustify changes to .c/.h files in the NetworkPkg package Cc: Andrew Fish <afish@apple.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
2021-06-09NetworkPkg/IScsiDxe: fix IScsiHexToBin() buffer overflowLaszlo Ersek1-0/+3
The IScsiHexToBin() function documents the EFI_BUFFER_TOO_SMALL return condition, but never actually checks whether the decoded buffer fits into the caller-provided room (i.e., the input value of "BinLength"), and EFI_BUFFER_TOO_SMALL is never returned. The decoding of "HexStr" can overflow "BinBuffer". This is remotely exploitable, as shown in a subsequent patch, which adds error checking to the IScsiHexToBin() call sites. This issue allows the target to compromise the initiator. Introduce EFI_BAD_BUFFER_SIZE, in addition to the existent EFI_BUFFER_TOO_SMALL, for reporting a special case of the buffer overflow, plus actually catch the buffer overflow. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210608121259.32451-10-lersek@redhat.com>
2021-06-09NetworkPkg/IScsiDxe: fix IScsiHexToBin() hex parsingLaszlo Ersek1-0/+1
The IScsiHexToBin() function has the following parser issues: (1) If the *subject sequence* in "HexStr" is empty, the function returns EFI_SUCCESS (with "BinLength" set to 0 on output). Such inputs should be rejected. (2) The function mis-handles a "HexStr" that ends with a stray nibble. For example, if "HexStr" is "0xABC", the function decodes it to the bytes {0xAB, 0x0C}, sets "BinLength" to 2 on output, and returns EFI_SUCCESS. Such inputs should be rejected. (3) If an invalid hex char is found in "HexStr", the function treats it as end-of-hex-string, and returns EFI_SUCCESS. Such inputs should be rejected. All of the above cases are remotely triggerable, as shown in a subsequent patch, which adds error checking to the IScsiHexToBin() call sites. While the initiator is not immediately compromised, incorrectly parsing CHAP_R from the target, in case of mutual authentication, is not great. Extend the interface contract of IScsiHexToBin() with EFI_INVALID_PARAMETER, for reporting issues (1) through (3), and implement the new checks. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210608121259.32451-9-lersek@redhat.com>
2021-06-09NetworkPkg/IScsiDxe: reformat IScsiHexToBin() leading comment blockLaszlo Ersek1-8/+8
We'll need further return values for IScsiHexToBin() in a subsequent patch; make room for them in the leading comment block of the function. While at it, rewrap the comment block to 80 characters width. No functional changes. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210608121259.32451-8-lersek@redhat.com>
2021-06-09NetworkPkg/IScsiDxe: fix potential integer overflow in IScsiBinToHex()Laszlo Ersek1-0/+1
Considering IScsiBinToHex(): > if (((*HexLength) - 3) < BinLength * 2) { > *HexLength = BinLength * 2 + 3; > } the following subexpressions are problematic: (*HexLength) - 3 BinLength * 2 BinLength * 2 + 3 The first one may wrap under zero, the latter two may wrap over MAX_UINT32. Rewrite the calculation using SafeIntLib. While at it, change the type of the "Index" variable from UINTN to UINT32. The largest "Index"-based value that we calculate is Index * 2 + 2 (with (Index == BinLength)) Because the patch makes BinLength * 2 + 3 safe to calculate in UINT32, using UINT32 for Index * 2 + 2 (with (Index == BinLength)) is safe too. Consistently using UINT32 improves readability. This patch is best reviewed with "git show -W". The integer overflows that this patch fixes are theoretical; a subsequent patch in the series will audit the IScsiBinToHex() call sites, and show that none of them can fail. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210608121259.32451-6-lersek@redhat.com>
2020-02-10NetworkPkg/IScsiDxe: Fix various typosAntoine Coeur1-4/+4
Fix various typos in comments and documentation. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@intel.com> Signed-off-by: Antoine Coeur <coeur@gmx.fr> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Signed-off-by: Philippe Mathieu-Daude <philmd@redhat.com> Message-Id: <20200207010831.9046-42-philmd@redhat.com>
2019-04-09NetworkPkg: Replace BSD License with BSD+Patent LicenseMichael D Kinney1-7/+1
https://bugzilla.tianocore.org/show_bug.cgi?id=1373 Replace BSD 2-Clause License with BSD+Patent License. This change is based on the following emails: https://lists.01.org/pipermail/edk2-devel/2019-February/036260.html https://lists.01.org/pipermail/edk2-devel/2018-October/030385.html RFCs with detailed process for the license change: V3: https://lists.01.org/pipermail/edk2-devel/2019-March/038116.html V2: https://lists.01.org/pipermail/edk2-devel/2019-March/037669.html V1: https://lists.01.org/pipermail/edk2-devel/2019-March/037500.html Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
2018-06-28NetworkPkg: Clean up source filesLiming Gao1-9/+9
1. Do not use tab characters 2. No trailing white space in one line 3. All files must end with CRLF Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Liming Gao <liming.gao@intel.com>
2017-10-26NetworkPkg/IScsiDxe: Add IPv6 support condition check.Jiaxin Wu1-1/+3
Base on the request of https://bugzilla.tianocore.org/show_bug.cgi?id=710, we provide this patch to IPv6 condition check by leveraging AIP Protocol. Cc: Karunakar P <karunakarp@amiindia.co.in> Cc: Ye Ting <ting.ye@intel.com> Cc: Fu Siyuan <siyuan.fu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Karunakar P <karunakarp@amiindia.co.in> Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Karunakar p <karunakarp@amiindia.co.in> Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com>
2017-02-23NetworkPkg:Add scriptable configuration to iSCSI driver by leveraging x-UEFI.Zhang Lubo1-0/+38
v2: Add error handling if can not create Attempts in driver entry point. Since we support to define a macro be a PCD value, we enhance our code by modifying the structure in IFR_NVDATA. This effect code logic mainly in Creating Keywords,Convert IFR NvData To AttemptConfigData ByKeyword and reverse function. Fix typo errors and sync based on the latest code. Enable iSCSI keywords configuration based on x-UEFI name space. we introduce new PCD to control the attempt numbers which will be created in non activated state, besides the Attempt name is changed to READ_ONLY attribute in UI. We can invoke KEYWORD HANDLER Protocol to configure the related keywords. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Zhang Lubo <lubo.zhang@intel.com> Cc: Ye Ting <ting.ye@intel.com> Cc: Fu Siyuan <siyuan.fu@intel.com> Cc: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Wu Jiaxin jiaxin.wu@intel.com
2017-01-19NetworkPkg: Add dns support for target URL configuration in ISCSI.Zhang Lubo1-1/+20
v2: *1. Add IScsiDnsIsConfigured function in IScsiSupported to check attempt using DNS protocol or not.2. Fix wrongs typos in IScsiDns.c and .uni file.3. define a macro for the length of target URL.4. update the Copyright to 2017. Add DNS support for target URL directly configuration in UI. Besides, When we enable the option (Get target info via DHCP) , the dhcp server will return target info include the rootpath, like the format "iscsi:"<servername>":"<protocol>":"<port>":"<LUN>":"<targetname> According to the RFC 4173,the server name region is expressed as IPv4(192.168.10.20 )or IPv6 ([2000:bbbb::3]) or domain name, but currently we only support the IP address format. To enable this feature, we can support both. Another enhancement is that we can deal with the data received from the iSCSI login response with an target redirection status, in which contains the Target Address in the format domainname[:port][,portal-group-tag] required by RFC 3720. Cc: Ye Ting <ting.ye@intel.com> Cc: Fu Siyuan <siyuan.fu@intel.com> Cc: Wu Jiaxin <jiaxin.wu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Zhang Lubo <lubo.zhang@intel.com> Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
2016-10-14NetworkPkg: Record user configured TargetIP/Port in iBFTYe Ting1-1/+6
Current ISCSI driver records redirected iSCSI targetIP/Port in iBFT once redirection occurs, which removes the possibility of the OS to reconnect to the configured IP for load balancing. The behavior is not explicitly described in IBFT spec, though the MSFT expert confirm we should record original user setting rather than publish the redirected IP. Thanks Sriram for reviewing and validating this patch in his test-bed. Cc: Subramanian Sriram <sriram-s@hpe.com> Cc: Fu Siyuan <siyuan.fu@intel.com> Cc: Zhang Lubo <lubo.zhang@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Subramanian Sriram <sriram-s@hpe.com>
2016-04-22NetworkPkg: refine codes of iSCSI driver.Zhang Lubo1-3/+6
Add error handling logic in DriverBingingStop function, it may return error status when invoking the UninstallProtocolInterface. Cc: Fu Siyuan <siyuan.fu@intel.com> Cc: Ye Ting <ting.ye@intel.com> Cc: Wu Jiaxin <jiaxin.wu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Zhang Lubo <lubo.zhang@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
2016-01-06NetworkPkg IScsiDxe: Fix typos in function descriptionsHao Wu1-1/+1
Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19601 6f19259b-4bc3-4df7-8a09-765794883524
2015-08-11NetworkPkg: Change the macro name to fit coding stylefanwang21-4/+4
Change several macro names to fit name EDK2 naming conventions: Use all capital letters for #define. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: fanwang2 <fan.wang@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com> Reviewed-by: Qiu Shumin <shumin.qiu@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18199 6f19259b-4bc3-4df7-8a09-765794883524
2015-07-27NetworkPkg: fix an error lead building crashfanwang21-1/+1
Fix an error which leads the building process crashes. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: fanwang2 <fan.wang@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18066 6f19259b-4bc3-4df7-8a09-765794883524
2015-07-26NetworkPkg: Add old IPv4_DEVICE_PATH and IPv6_DEVICE_PATH supportfanwang21-1/+17
GatewayIpAddress and SubnetMask do not exist in old IPv4_DEVICE_PATH, IPAddressOrigin, PrefixLength and GatewayIPAddress do not exist in old IPv6_DEVICE_PATH. This will lead new IScsiDxe to error without updating IPv4_DEVICE_PATH and IPv6_DEVICE_PATH in system. Following UEFI2.5 spec of IPv4_DEVICE_PATH do a check before accessing fields only defined in new version's IPv4_DEVICE_PATH, and revise the same issue for IPv6_DEVICE_PATH in Iscsi driver. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: fanwang2 <fan.wang@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> [lersek@redhat.com: rewrapped commit message] Signed-off-by: Laszlo Ersek <lersek@redhat.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18056 6f19259b-4bc3-4df7-8a09-765794883524
2014-01-10Fix bug in unload function: Check if component name protocol exist, only ↵Fu Siyuan1-1/+31
uninstall it when it really exists. Signed-off-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Tian, Feng <feng.tian@intel.com> Reviewed-by: Jin, Eric <eric.jin@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15092 6f19259b-4bc3-4df7-8a09-765794883524
2013-10-25Fix a bug about the iSCSI DHCP dependency issue.Wu Jiaxin1-1/+17
Create rules to determine whether iSCSI need DHCP protocol in current configuration by examining user’s configuration data in DriverBindingSupported(). Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com > Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@14803 6f19259b-4bc3-4df7-8a09-765794883524
2012-10-171. Fix a bug in PXE driver that the PXE boot do not restart if a new boot ↵sfu51-3/+4
option on the different IP stack is selected. 2. Retrieve the IP information after iSCSI TCPv6 connection established and fill it into iBFT table. 3. Generate a random IAID for each NIC port to require different IPv6 address in PXE driver. 4. Update function EfiMtftp6Configure() and Mtftp6RrqHandleOack() to allocate at most one UdpIo. 5. Fix a typo from “destory” to “destroy” in network code. Signed-off-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Ouyang Qian <qian.ouyang@intel.com> git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13859 6f19259b-4bc3-4df7-8a09-765794883524
2011-08-17Add IScsiDxe driver to NetworkPkg in order to support iSCSI over IPv6 stack ↵tye11-0/+343
and iSCSI MPIO. Signed-off-by: tye1 Reviewed-by: hhuan13 Reviewed-by: eric_tian git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@12149 6f19259b-4bc3-4df7-8a09-765794883524
generated by cgit v1.1 at 2024-10-10 06:24:19 +0000