From patchwork Wed Apr 24 01:52:16 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mike Christie X-Patchwork-Id: 10913963 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 642131390 for ; Wed, 24 Apr 2019 01:52:22 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 54491289EF for ; Wed, 24 Apr 2019 01:52:22 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4842328A0D; Wed, 24 Apr 2019 01:52:22 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EC21628A0B for ; Wed, 24 Apr 2019 01:52:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729201AbfDXBwT (ORCPT ); Tue, 23 Apr 2019 21:52:19 -0400 Received: from mx1.redhat.com ([209.132.183.28]:51706 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729113AbfDXBwT (ORCPT ); Tue, 23 Apr 2019 21:52:19 -0400 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 5415130C45A9; Wed, 24 Apr 2019 01:52:19 +0000 (UTC) Received: from rh2.redhat.com (ovpn-124-137.rdu2.redhat.com [10.10.124.137]) by smtp.corp.redhat.com (Postfix) with ESMTP id 53AFA19936; Wed, 24 Apr 2019 01:52:18 +0000 (UTC) From: Mike Christie To: martin.petersen@oracle.com, linux-scsi@vger.kernel.org, target-devel@vger.kernel.org, nab@linux-iscsi.org Cc: Mike Christie Subject: [PATCH 1/1] iscsi target: fix discovery auth enforcement Date: Tue, 23 Apr 2019 20:52:16 -0500 Message-Id: <20190424015216.16757-1-mchristi@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.44]); Wed, 24 Apr 2019 01:52:19 +0000 (UTC) Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If the user writes 0 to enforce_discovery_auth to disable CHAP during discovery we will set the AuthMethod arguments to CHAP,None even if there are no CHAP settings. The initiator can then only login if it has its AuthMethod set to only None. If it is set to CHAP,None, login will fail, because the target sees CHAP and will try to do that, but it will always fail since there are no CHAP settings setup. This has us use CHAP,None if CHAP is setup when writing 0 to enforce_discovery_auth file and None if CHAP is not setup. Signed-off-by: Mike Christie --- drivers/target/iscsi/iscsi_target_configfs.c | 24 ++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c index cac94c94ef5d..bfc4a7966a2d 100644 --- a/drivers/target/iscsi/iscsi_target_configfs.c +++ b/drivers/target/iscsi/iscsi_target_configfs.c @@ -1276,6 +1276,7 @@ static ssize_t iscsi_disc_enforce_discovery_auth_store(struct config_item *item, { struct iscsi_param *param; struct iscsi_portal_group *discovery_tpg = iscsit_global->discovery_tpg; + struct iscsi_node_auth *auth = &iscsit_global->discovery_acl.node_auth; u32 op; int err; @@ -1306,19 +1307,34 @@ static ssize_t iscsi_disc_enforce_discovery_auth_store(struct config_item *item, return -EINVAL; discovery_tpg->tpg_attrib.authentication = 1; - iscsit_global->discovery_acl.node_auth.enforce_discovery_auth = 1; + auth->enforce_discovery_auth = 1; pr_debug("LIO-CORE[0] Successfully enabled" " authentication enforcement for iSCSI" " Discovery TPG\n"); - } else { + } else if ((auth->naf_flags & NAF_USERID_SET && + auth->naf_flags & NAF_PASSWORD_SET) || + (auth->naf_flags & NAF_USERID_IN_SET && + auth->naf_flags & NAF_PASSWORD_IN_SET)) { /* - * Reset the AuthMethod key to CHAP,None + * Partially disable. Reset AuthMethod key to CHAP,None */ if (iscsi_update_param_value(param, "CHAP,None") < 0) return -EINVAL; discovery_tpg->tpg_attrib.authentication = 0; - iscsit_global->discovery_acl.node_auth.enforce_discovery_auth = 0; + auth->enforce_discovery_auth = 0; + pr_debug("LIO-CORE[0] Partially disabled" + " authentication enforcement for iSCSI" + " Discovery TPG\n"); + } else { + /* + * Fully disable. Reset AuthMethod key to None + */ + if (iscsi_update_param_value(param, "None") < 0) + return -EINVAL; + + discovery_tpg->tpg_attrib.authentication = 0; + auth->enforce_discovery_auth = 0; pr_debug("LIO-CORE[0] Successfully disabled" " authentication enforcement for iSCSI" " Discovery TPG\n");