summaryrefslogtreecommitdiff
path: root/drivers/target
diff options
context:
space:
mode:
authorEric Seppanen <eric@purestorage.com>2013-11-20 14:19:52 -0800
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-12-04 10:56:15 -0800
commit6aec95b47deb9e3dad4cb2e6db87f3b03544224d (patch)
treecbcd2847d3c3b246b2697bf2dab3eb16157c0c44 /drivers/target
parente97f132f0e66893138f64b681cddff2d2ff37b53 (diff)
downloadlinux-3.10-6aec95b47deb9e3dad4cb2e6db87f3b03544224d.tar.gz
linux-3.10-6aec95b47deb9e3dad4cb2e6db87f3b03544224d.tar.bz2
linux-3.10-6aec95b47deb9e3dad4cb2e6db87f3b03544224d.zip
iscsi-target: chap auth shouldn't match username with trailing garbage
commit 86784c6bdeeef78eed94d298be7a8879f6a97ee2 upstream. In iSCSI negotiations with initiator CHAP enabled, usernames with trailing garbage are permitted, because the string comparison only checks the strlen of the configured username. e.g. "usernameXXXXX" will be permitted to match "username". Just check one more byte so the trailing null char is also matched. Signed-off-by: Eric Seppanen <eric@purestorage.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/target')
-rw-r--r--drivers/target/iscsi/iscsi_target_auth.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index cee17543278..130a1e4f96a 100644
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -148,6 +148,7 @@ static int chap_server_compute_md5(
unsigned char client_digest[MD5_SIGNATURE_SIZE];
unsigned char server_digest[MD5_SIGNATURE_SIZE];
unsigned char chap_n[MAX_CHAP_N_SIZE], chap_r[MAX_RESPONSE_LENGTH];
+ size_t compare_len;
struct iscsi_chap *chap = conn->auth_protocol;
struct crypto_hash *tfm;
struct hash_desc desc;
@@ -186,7 +187,9 @@ static int chap_server_compute_md5(
goto out;
}
- if (memcmp(chap_n, auth->userid, strlen(auth->userid)) != 0) {
+ /* Include the terminating NULL in the compare */
+ compare_len = strlen(auth->userid) + 1;
+ if (strncmp(chap_n, auth->userid, compare_len) != 0) {
pr_err("CHAP_N values do not match!\n");
goto out;
}