Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

iscsi-scst: Add SHA256 and SHA3-256 support to CHAP #277

Merged
merged 1 commit into from
Feb 3, 2025

Conversation

bmeagherix
Copy link
Contributor

At the moment SCST contains support for 2 CHAP algorithms: MD5 and SHA1. Linux LIO and open-iscsi both include these, as well as SHA256 and SHA3-256 (since 2019).

This PR adds SHA256 and SHA3-256 support to CHAP. Since in SCST CHAP negotiation is performed by the userspace iscsi-scstd daemon, the PR uses the kernel userspace AL_ALG API to access the additional hash functions.

If configured for CHAP, on iSCSI login the client will present an ordered list of desired algorithms. During this negotiation, if the client requests SHA256 or SHA3-256 we verify that the kernel supports the algorithm before agreeing to use it.


Did some testing using open-iscsi with target settings modified from the default, e.g.

node.session.auth.chap_algs = SHA256
node.session.auth.username = testuser1
node.session.auth.password = testpass1234

And adding for Mutual Auth

node.session.auth.username_in = testuser2
node.session.auth.password_in = testpass4321

Use the kernel userspace AL_ALG API to access additional hash
functions "sha256" and "sha3-256".

If configured for CHAP, on iSCSI login the client will present an
ordered list of desired algorithms.  During this negotiation, if
the client requests SHA256 or SHA3-256 we verify that the kernel
supports the algorithm before agreeing to use it.
@lnocturno lnocturno merged commit 146d79e into SCST-project:master Feb 3, 2025
33 checks passed
@lnocturno
Copy link
Contributor

Hi Brian,

Thank you for the patch!

Thanks,
Gleb

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants