command/channel_auth.cpp

#include "channel_auth.hpp"

#include <errno.h>
#include <ipmid/api.h>

#include <ipmid/types.hpp>
#include <ipmid/utils.hpp>
#include <nlohmann/json.hpp>
#include <phosphor-logging/elog-errors.hpp>
#include <phosphor-logging/lg2.hpp>
#include <user_channel/channel_layer.hpp>
#include <user_channel/user_layer.hpp>
#include <xyz/openbmc_project/Common/error.hpp>

#include <fstream>
#include <set>
#include <string>

namespace command
{

using namespace phosphor::logging;
using namespace sdbusplus::xyz::openbmc_project::Common::Error;
using Json = nlohmann::json;

std::vector<uint8_t>
    GetChannelCapabilities(const std::vector<uint8_t>& inPayload,
                           std::shared_ptr<message::Handler>& /* handler */)
{
    auto request =
        reinterpret_cast<const GetChannelCapabilitiesReq*>(inPayload.data());
    if (inPayload.size() != sizeof(*request))
    {
        std::vector<uint8_t> errorPayload{IPMI_CC_REQ_DATA_LEN_INVALID};
        return errorPayload;
    }
    constexpr unsigned int channelMask = 0x0f;
    uint8_t chNum = ipmi::convertCurrentChannelNum(
        request->channelNumber & channelMask, getInterfaceIndex());

    if (!ipmi::isValidChannel(chNum) ||
        (ipmi::EChannelSessSupported::none ==
         ipmi::getChannelSessionSupport(chNum)) ||
        !ipmi::isValidPrivLimit(request->reqMaxPrivLevel))
    {
        std::vector<uint8_t> errorPayload{IPMI_CC_INVALID_FIELD_REQUEST};
        return errorPayload;
    }

    std::vector<uint8_t> outPayload(sizeof(GetChannelCapabilitiesResp));
    auto response =
        reinterpret_cast<GetChannelCapabilitiesResp*>(outPayload.data());

    // A canned response, since there is no user and channel management.
    response->completionCode = IPMI_CC_OK;

    response->channelNumber = chNum;

    response->ipmiVersion = 1; // IPMI v2.0 extended capabilities available.
    response->reserved1 = 0;
    response->oem = 0;
    response->straightKey = 0;
    response->reserved2 = 0;
    response->md5 = 0;
    response->md2 = 0;

    response->reserved3 = 0;
    response->KGStatus = 0;       // KG is set to default
    response->perMessageAuth = 0; // Per-message Authentication is enabled
    response->userAuth = 0;       // User Level Authentication is enabled
    uint8_t maxChUsers = 0;
    uint8_t enabledUsers = 0;
    uint8_t fixedUsers = 0;
    ipmi::ipmiUserGetAllCounts(maxChUsers, enabledUsers, fixedUsers);

    response->nonNullUsers = enabledUsers > 0 ? 1 : 0; // Non-null usernames
    response->nullUsers = 0;      // Null usernames disabled
    response->anonymousLogin = 0; // Anonymous Login disabled

    response->reserved4 = 0;
    response->extCapabilities = 0x2; // Channel supports IPMI v2.0 connections

    response->oemID[0] = 0;
    response->oemID[1] = 0;
    response->oemID[2] = 0;
    response->oemAuxillary = 0;
    return outPayload;
}

static constexpr const char* configFile =
    "/usr/share/ipmi-providers/cipher_list.json";
static constexpr const char* cipher = "cipher";
static constexpr uint8_t stdCipherSuite = 0xC0;
static constexpr uint8_t oemCipherSuite = 0xC1;
static constexpr const char* oem = "oemiana";
static constexpr const char* auth = "authentication";
static constexpr const char* integrity = "integrity";
static constexpr uint8_t integrityTag = 0x40;
static constexpr const char* conf = "confidentiality";
static constexpr uint8_t confTag = 0x80;

/** @brief Get the supported Cipher records
 *
 * The cipher records are read from the JSON file and converted into
 * 1. cipher suite record format mentioned in the IPMI specification. The
 * records can be either OEM or standard cipher. Each json entry is parsed and
 * converted into the cipher record format and pushed into the vector.
 * 2. Algorithms listed in vector format
 *
 * @return pair of vector containing 1. all the cipher suite records. 2.
 * Algorithms supported
 *
 */
static std::pair<std::vector<uint8_t>, std::vector<uint8_t>> getCipherRecords()
{
    std::vector<uint8_t> cipherRecords;
    std::vector<uint8_t> supportedAlgorithmRecords;
    // create set to get the unique supported algorithms
    std::set<uint8_t> supportedAlgorithmSet;

    std::ifstream jsonFile(configFile);
    if (!jsonFile.is_open())
    {
        lg2::error("Channel Cipher suites file not found: {ERROR}", "ERROR",
                   strerror(errno));
        elog<InternalFailure>();
    }

    auto data = Json::parse(jsonFile, nullptr, false);
    if (data.is_discarded())
    {
        lg2::error("Parsing channel cipher suites JSON failed: {ERROR}",
                   "ERROR", strerror(errno));
        elog<InternalFailure>();
    }

    for (const auto& record : data)
    {
        if (record.find(oem) != record.end())
        {
            // OEM cipher suite - 0xC1
            cipherRecords.push_back(oemCipherSuite);
            // Cipher Suite ID
            cipherRecords.push_back(record.value(cipher, 0));
            // OEM IANA - 3 bytes
            cipherRecords.push_back(record.value(oem, 0));
            cipherRecords.push_back(record.value(oem, 0) >> 8);
            cipherRecords.push_back(record.value(oem, 0) >> 16);
        }
        else
        {
            // Standard cipher suite - 0xC0
            cipherRecords.push_back(stdCipherSuite);
            // Cipher Suite ID
            cipherRecords.push_back(record.value(cipher, 0));
        }

        // Authentication algorithm number
        cipherRecords.push_back(record.value(auth, 0));
        supportedAlgorithmSet.insert(record.value(auth, 0));

        // Integrity algorithm number
        cipherRecords.push_back(record.value(integrity, 0) | integrityTag);
        supportedAlgorithmSet.insert(record.value(integrity, 0) | integrityTag);

        // Confidentiality algorithm number
        cipherRecords.push_back(record.value(conf, 0) | confTag);
        supportedAlgorithmSet.insert(record.value(conf, 0) | confTag);
    }

    // copy the set to supportedAlgorithmRecord which is vector based.
    std::copy(supportedAlgorithmSet.begin(), supportedAlgorithmSet.end(),
              std::back_inserter(supportedAlgorithmRecords));

    return std::make_pair(cipherRecords, supportedAlgorithmRecords);
}

/** @brief this command is used to look up what authentication, integrity,
 *  confidentiality algorithms are supported.
 *
 *  @ param inPayload - vector of input data
 *  @ param handler - pointer to handler
 *
 *  @returns ipmi completion code plus response data
 *   - vector of response data: cc, channel, record data
 **/
std::vector<uint8_t>
    getChannelCipherSuites(const std::vector<uint8_t>& inPayload,
                           std::shared_ptr<message::Handler>& /* handler */)
{
    const auto errorResponse = [](uint8_t cc) {
        std::vector<uint8_t> rsp(1);
        rsp[0] = cc;
        return rsp;
    };

    static constexpr size_t getChannelCipherSuitesReqLen = 3;
    if (inPayload.size() != getChannelCipherSuitesReqLen)
    {
        return errorResponse(IPMI_CC_REQ_DATA_LEN_INVALID);
    }

    static constexpr uint8_t channelMask = 0x0f;
    uint8_t channelNumber = inPayload[0] & channelMask;
    if (channelNumber != inPayload[0])
    {
        return errorResponse(IPMI_CC_INVALID_FIELD_REQUEST);
    }
    static constexpr uint8_t payloadMask = 0x3f;
    uint8_t payloadType = inPayload[1] & payloadMask;
    if (payloadType != inPayload[1])
    {
        return errorResponse(IPMI_CC_INVALID_FIELD_REQUEST);
    }
    static constexpr uint8_t indexMask = 0x3f;
    uint8_t listIndex = inPayload[2] & indexMask;
    static constexpr uint8_t algoSelectShift = 7;
    uint8_t algoSelectBit = inPayload[2] >> algoSelectShift;
    if ((listIndex | (algoSelectBit << algoSelectShift)) != inPayload[2])
    {
        return errorResponse(IPMI_CC_INVALID_FIELD_REQUEST);
    }

    static std::vector<uint8_t> cipherRecords;
    static std::vector<uint8_t> supportedAlgorithms;
    static bool recordInit = false;

    uint8_t rspChannel = ipmi::convertCurrentChannelNum(channelNumber,
                                                        getInterfaceIndex());

    if (!ipmi::isValidChannel(rspChannel))
    {
        return errorResponse(IPMI_CC_INVALID_FIELD_REQUEST);
    }
    if (!ipmi::isValidPayloadType(static_cast<ipmi::PayloadType>(payloadType)))
    {
        lg2::debug("Get channel cipher suites - Invalid payload type: {ERROR}",
                   "ERROR", strerror(errno));
        constexpr uint8_t ccPayloadTypeNotSupported = 0x80;
        return errorResponse(ccPayloadTypeNotSupported);
    }

    if (!recordInit)
    {
        try
        {
            std::tie(cipherRecords, supportedAlgorithms) = getCipherRecords();
            recordInit = true;
        }
        catch (const std::exception& e)
        {
            return errorResponse(IPMI_CC_UNSPECIFIED_ERROR);
        }
    }

    const std::vector<uint8_t>& records = algoSelectBit ? cipherRecords
                                                        : supportedAlgorithms;
    static constexpr auto respSize = 16;

    // Session support is available in active LAN channels.
    if ((ipmi::getChannelSessionSupport(rspChannel) ==
         ipmi::EChannelSessSupported::none) ||
        !(ipmi::doesDeviceExist(rspChannel)))
    {
        lg2::debug("Get channel cipher suites - Device does not exist:{ERROR}",
                   "ERROR", strerror(errno));
        return errorResponse(IPMI_CC_INVALID_FIELD_REQUEST);
    }

    // List index(00h-3Fh), 0h selects the first set of 16, 1h selects the next
    // set of 16 and so on.

    // Calculate the number of record data bytes to be returned.
    auto start = std::min(static_cast<size_t>(listIndex) * respSize,
                          records.size());
    auto end = std::min((static_cast<size_t>(listIndex) * respSize) + respSize,
                        records.size());
    auto size = end - start;

    std::vector<uint8_t> rsp;
    rsp.push_back(IPMI_CC_OK);
    rsp.push_back(rspChannel);
    std::copy_n(records.data() + start, size, std::back_inserter(rsp));

    return rsp;
}

} // namespace command