Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 1 | #pragma once |
| 2 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 3 | #include "auth_algo.hpp" |
| 4 | #include "crypt_algo.hpp" |
| 5 | #include "endian.hpp" |
| 6 | #include "integrity_algo.hpp" |
Vernon Mauery | 8977d12 | 2018-10-24 14:02:16 -0700 | [diff] [blame] | 7 | #include "prng.hpp" |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 8 | #include "socket_channel.hpp" |
| 9 | |
Suryakanth Sekar | f8a34fc | 2019-06-12 20:59:18 +0530 | [diff] [blame] | 10 | #include <ipmid/api.hpp> |
| 11 | #include <ipmid/sessiondef.hpp> |
Suryakanth Sekar | f8a34fc | 2019-06-12 20:59:18 +0530 | [diff] [blame] | 12 | #include <sdbusplus/bus.hpp> |
| 13 | #include <sdbusplus/server/object.hpp> |
Richard Marian Thomaiyar | 992e53c | 2019-03-03 13:30:46 +0530 | [diff] [blame] | 14 | #include <user_channel/channel_layer.hpp> |
| 15 | #include <user_channel/user_layer.hpp> |
Suryakanth Sekar | f8a34fc | 2019-06-12 20:59:18 +0530 | [diff] [blame] | 16 | #include <xyz/openbmc_project/Ipmi/SessionInfo/server.hpp> |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 17 | |
George Liu | bc8958f | 2022-07-04 09:29:49 +0800 | [diff] [blame] | 18 | #include <chrono> |
| 19 | #include <exception> |
| 20 | #include <list> |
| 21 | #include <memory> |
| 22 | #include <string> |
| 23 | #include <unordered_map> |
| 24 | #include <vector> |
| 25 | |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 26 | namespace session |
| 27 | { |
| 28 | |
| 29 | using namespace std::chrono_literals; |
| 30 | using SessionID = uint32_t; |
| 31 | |
| 32 | enum class Privilege : uint8_t |
| 33 | { |
| 34 | HIGHEST_MATCHING, |
| 35 | CALLBACK, |
| 36 | USER, |
| 37 | OPERATOR, |
| 38 | ADMIN, |
| 39 | OEM, |
| 40 | }; |
| 41 | |
Richard Marian Thomaiyar | 127748a | 2018-09-06 07:08:51 +0530 | [diff] [blame] | 42 | // Mask to get only the privilege from requested maximum privlege (RAKP message |
| 43 | // 1) |
| 44 | constexpr uint8_t reqMaxPrivMask = 0xF; |
| 45 | |
Tom Joseph | 3563f8f | 2017-05-08 15:42:54 +0530 | [diff] [blame] | 46 | /** |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 47 | * @struct SequenceNumbers Session Sequence Numbers |
| 48 | * |
| 49 | * IPMI v2.0 RMCP+ Session Sequence Numbers are used for rejecting packets that |
| 50 | * may have been duplicated by the network or intentionally replayed. There are |
| 51 | * two sets of Session SequenceNumbers for a given session.One set of inbound |
| 52 | * and outbound sequence numbers is used for authenticated (signed) packets, |
| 53 | * and the other set is used for unauthenticated packets. |
| 54 | * |
| 55 | * The individual Session Sequence Numbers is are initialized to zero whenever |
| 56 | * a session is created and incremented by one at the start of outbound |
| 57 | * processing for a given packet (i.e. the first transmitted packet has a ‘1’ |
| 58 | * as the sequence number, not 0). Session Sequence numbers are incremented for |
| 59 | * every packet that is transmitted by a given sender, regardless of whether |
| 60 | * the payload for the packet is a ‘retry’ or not. |
| 61 | */ |
| 62 | struct SequenceNumbers |
| 63 | { |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 64 | auto get(bool inbound = true) const |
| 65 | { |
| 66 | return inbound ? in : out; |
| 67 | } |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 68 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 69 | void set(uint32_t seqNumber, bool inbound = true) |
| 70 | { |
| 71 | inbound ? (in = seqNumber) : (out = seqNumber); |
| 72 | } |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 73 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 74 | auto increment() |
| 75 | { |
| 76 | return ++out; |
| 77 | } |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 78 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 79 | private: |
| 80 | uint32_t in = 0; |
| 81 | uint32_t out = 0; |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 82 | }; |
Tom Joseph | 3563f8f | 2017-05-08 15:42:54 +0530 | [diff] [blame] | 83 | /** |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 84 | * @class Session |
| 85 | * |
| 86 | * Encapsulates the data related to an IPMI Session |
| 87 | * |
| 88 | * Authenticated IPMI communication to the BMC is accomplished by establishing |
| 89 | * a session. Once established, a session is identified by a Session ID. The |
| 90 | * Session ID may be thought of as a handle that identifies a connection between |
| 91 | * a given remote user and the BMC. The specification supports having multiple |
| 92 | * active sessions established with the BMC. It is recommended that a BMC |
| 93 | * implementation support at least four simultaneous sessions |
| 94 | */ |
Suryakanth Sekar | f8a34fc | 2019-06-12 20:59:18 +0530 | [diff] [blame] | 95 | |
| 96 | using SessionIface = sdbusplus::server::object::object< |
| 97 | sdbusplus::xyz::openbmc_project::Ipmi::server::SessionInfo>; |
| 98 | |
| 99 | class Session : public SessionIface |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 100 | { |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 101 | public: |
| 102 | Session() = default; |
| 103 | ~Session() = default; |
| 104 | Session(const Session&) = delete; |
| 105 | Session& operator=(const Session&) = delete; |
| 106 | Session(Session&&) = default; |
| 107 | Session& operator=(Session&&) = default; |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 108 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 109 | /** |
| 110 | * @brief Session Constructor |
| 111 | * |
| 112 | * This is issued by the Session Manager when a session is started for |
| 113 | * the Open SessionRequest command |
| 114 | * |
| 115 | * @param[in] inRemoteConsoleSessID - Remote Console Session ID |
| 116 | * @param[in] priv - Privilege Level requested in the Command |
| 117 | */ |
Suryakanth Sekar | f8a34fc | 2019-06-12 20:59:18 +0530 | [diff] [blame] | 118 | Session(sdbusplus::bus::bus& bus, const char* path, |
| 119 | SessionID inRemoteConsoleSessID, SessionID BMCSessionID, |
| 120 | char priv) : |
| 121 | SessionIface(bus, path) |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 122 | { |
Suryakanth Sekar | f8a34fc | 2019-06-12 20:59:18 +0530 | [diff] [blame] | 123 | reqMaxPrivLevel = static_cast<session::Privilege>(priv); |
| 124 | bmcSessionID = BMCSessionID; |
| 125 | remoteConsoleSessionID = inRemoteConsoleSessID; |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 126 | } |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 127 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 128 | auto getBMCSessionID() const |
| 129 | { |
| 130 | return bmcSessionID; |
| 131 | } |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 132 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 133 | auto getRCSessionID() const |
| 134 | { |
| 135 | return remoteConsoleSessionID; |
| 136 | } |
| 137 | |
| 138 | auto getAuthAlgo() const |
| 139 | { |
| 140 | if (authAlgoInterface) |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 141 | { |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 142 | return authAlgoInterface.get(); |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 143 | } |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 144 | else |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 145 | { |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 146 | throw std::runtime_error("Authentication Algorithm Empty"); |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 147 | } |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 148 | } |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 149 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 150 | void setAuthAlgo(std::unique_ptr<cipher::rakp_auth::Interface>&& inAuthAlgo) |
| 151 | { |
| 152 | authAlgoInterface = std::move(inAuthAlgo); |
| 153 | } |
| 154 | |
| 155 | /** |
| 156 | * @brief Get Session's Integrity Algorithm |
| 157 | * |
| 158 | * @return pointer to the integrity algorithm |
| 159 | */ |
| 160 | auto getIntegrityAlgo() const |
| 161 | { |
| 162 | if (integrityAlgoInterface) |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 163 | { |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 164 | return integrityAlgoInterface.get(); |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 165 | } |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 166 | else |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 167 | { |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 168 | throw std::runtime_error("Integrity Algorithm Empty"); |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 169 | } |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 170 | } |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 171 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 172 | /** |
| 173 | * @brief Set Session's Integrity Algorithm |
| 174 | * |
| 175 | * @param[in] integrityAlgo - unique pointer to integrity algorithm |
| 176 | * instance |
| 177 | */ |
| 178 | void setIntegrityAlgo( |
| 179 | std::unique_ptr<cipher::integrity::Interface>&& integrityAlgo) |
| 180 | { |
| 181 | integrityAlgoInterface = std::move(integrityAlgo); |
| 182 | } |
| 183 | |
| 184 | /** @brief Check if integrity algorithm is enabled for this session. |
| 185 | * |
| 186 | * @return true if integrity algorithm is enabled else false. |
| 187 | */ |
| 188 | auto isIntegrityAlgoEnabled() |
| 189 | { |
| 190 | return integrityAlgoInterface ? true : false; |
| 191 | } |
| 192 | |
| 193 | /** |
| 194 | * @brief Get Session's Confidentiality Algorithm |
| 195 | * |
| 196 | * @return pointer to the confidentiality algorithm |
| 197 | */ |
| 198 | auto getCryptAlgo() const |
| 199 | { |
| 200 | if (cryptAlgoInterface) |
Tom Joseph | 638d066 | 2017-01-10 16:02:07 +0530 | [diff] [blame] | 201 | { |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 202 | return cryptAlgoInterface.get(); |
Tom Joseph | 638d066 | 2017-01-10 16:02:07 +0530 | [diff] [blame] | 203 | } |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 204 | else |
Tom Joseph | 638d066 | 2017-01-10 16:02:07 +0530 | [diff] [blame] | 205 | { |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 206 | throw std::runtime_error("Confidentiality Algorithm Empty"); |
Tom Joseph | 638d066 | 2017-01-10 16:02:07 +0530 | [diff] [blame] | 207 | } |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 208 | } |
Tom Joseph | 638d066 | 2017-01-10 16:02:07 +0530 | [diff] [blame] | 209 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 210 | /** |
| 211 | * @brief Set Session's Confidentiality Algorithm |
| 212 | * |
| 213 | * @param[in] confAlgo - unique pointer to confidentiality algorithm |
| 214 | * instance |
| 215 | */ |
| 216 | void setCryptAlgo(std::unique_ptr<cipher::crypt::Interface>&& cryptAlgo) |
| 217 | { |
| 218 | cryptAlgoInterface = std::move(cryptAlgo); |
| 219 | } |
Tom Joseph | d8c7861 | 2017-03-31 10:17:30 +0530 | [diff] [blame] | 220 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 221 | /** @brief Check if confidentiality algorithm is enabled for this |
| 222 | * session. |
| 223 | * |
| 224 | * @return true if confidentiality algorithm is enabled else false. |
| 225 | */ |
| 226 | auto isCryptAlgoEnabled() |
| 227 | { |
| 228 | return cryptAlgoInterface ? true : false; |
| 229 | } |
Tom Joseph | 491dbd0 | 2017-01-24 18:20:41 +0530 | [diff] [blame] | 230 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 231 | void updateLastTransactionTime() |
| 232 | { |
| 233 | lastTime = std::chrono::steady_clock::now(); |
| 234 | } |
Tom Joseph | 491dbd0 | 2017-01-24 18:20:41 +0530 | [diff] [blame] | 235 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 236 | /** |
| 237 | * @brief Session Active Status |
| 238 | * |
| 239 | * Session Active status is decided upon the Session State and the last |
| 240 | * transaction time is compared against the session inactivity timeout. |
| 241 | * |
Vernon Mauery | ecc8efa | 2021-06-12 12:52:23 -0700 | [diff] [blame] | 242 | * @param[in] activeGrace - microseconds of idle time for active sessions |
| 243 | * @param[in] setupGrace - microseconds of idle time for sessions in setup |
| 244 | * |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 245 | */ |
Vernon Mauery | ecc8efa | 2021-06-12 12:52:23 -0700 | [diff] [blame] | 246 | bool isSessionActive(const std::chrono::microseconds& activeGrace, |
| 247 | const std::chrono::microseconds& setupGrace) |
Vernon Mauery | 07e5b28 | 2018-10-24 13:11:23 -0700 | [diff] [blame] | 248 | { |
| 249 | auto currentTime = std::chrono::steady_clock::now(); |
Vernon Mauery | ecc8efa | 2021-06-12 12:52:23 -0700 | [diff] [blame] | 250 | auto elapsedMicros = |
| 251 | std::chrono::duration_cast<std::chrono::microseconds>(currentTime - |
| 252 | lastTime); |
Vernon Mauery | 07e5b28 | 2018-10-24 13:11:23 -0700 | [diff] [blame] | 253 | |
Vernon Mauery | ecc8efa | 2021-06-12 12:52:23 -0700 | [diff] [blame] | 254 | State state = static_cast<session::State>(this->state()); |
Suryakanth Sekar | f8a34fc | 2019-06-12 20:59:18 +0530 | [diff] [blame] | 255 | |
Vernon Mauery | 07e5b28 | 2018-10-24 13:11:23 -0700 | [diff] [blame] | 256 | switch (state) |
| 257 | { |
Vernon Mauery | ecc8efa | 2021-06-12 12:52:23 -0700 | [diff] [blame] | 258 | case State::active: |
| 259 | if (elapsedMicros < activeGrace) |
Vernon Mauery | 07e5b28 | 2018-10-24 13:11:23 -0700 | [diff] [blame] | 260 | { |
| 261 | return true; |
| 262 | } |
| 263 | break; |
Vernon Mauery | ecc8efa | 2021-06-12 12:52:23 -0700 | [diff] [blame] | 264 | case State::setupInProgress: |
| 265 | if (elapsedMicros < setupGrace) |
Vernon Mauery | 07e5b28 | 2018-10-24 13:11:23 -0700 | [diff] [blame] | 266 | { |
| 267 | return true; |
| 268 | } |
| 269 | break; |
Vernon Mauery | ecc8efa | 2021-06-12 12:52:23 -0700 | [diff] [blame] | 270 | case State::tearDownInProgress: |
| 271 | break; |
Vernon Mauery | 07e5b28 | 2018-10-24 13:11:23 -0700 | [diff] [blame] | 272 | default: |
Vernon Mauery | ecc8efa | 2021-06-12 12:52:23 -0700 | [diff] [blame] | 273 | break; |
Vernon Mauery | 07e5b28 | 2018-10-24 13:11:23 -0700 | [diff] [blame] | 274 | } |
| 275 | return false; |
| 276 | } |
Tom Joseph | 895df94 | 2017-03-31 10:19:40 +0530 | [diff] [blame] | 277 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 278 | /** |
Richard Marian Thomaiyar | 127748a | 2018-09-06 07:08:51 +0530 | [diff] [blame] | 279 | * @brief Session's Requested Maximum Privilege Level |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 280 | */ |
Tom Joseph | 4021b1f | 2019-02-12 10:10:12 +0530 | [diff] [blame] | 281 | Privilege reqMaxPrivLevel; |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 282 | |
Richard Marian Thomaiyar | 992e53c | 2019-03-03 13:30:46 +0530 | [diff] [blame] | 283 | /** |
| 284 | * @brief session's user & channel access details |
| 285 | */ |
| 286 | ipmi::PrivAccess sessionUserPrivAccess{}; |
| 287 | ipmi::ChannelAccess sessionChannelAccess{}; |
| 288 | |
Suryakanth Sekar | f8a34fc | 2019-06-12 20:59:18 +0530 | [diff] [blame] | 289 | SequenceNumbers sequenceNums; // Session Sequence Numbers |
| 290 | std::string userName{}; // User Name |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 291 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 292 | /** @brief Socket channel for communicating with the remote client.*/ |
| 293 | std::shared_ptr<udpsocket::Channel> channelPtr; |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 294 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 295 | private: |
| 296 | SessionID bmcSessionID = 0; // BMC Session ID |
| 297 | SessionID remoteConsoleSessionID = 0; // Remote Console Session ID |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 298 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 299 | // Authentication Algorithm Interface for the Session |
| 300 | std::unique_ptr<cipher::rakp_auth::Interface> authAlgoInterface; |
Tom Joseph | cc27e12 | 2017-03-31 10:21:04 +0530 | [diff] [blame] | 301 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 302 | // Integrity Algorithm Interface for the Session |
| 303 | std::unique_ptr<cipher::integrity::Interface> integrityAlgoInterface = |
| 304 | nullptr; |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 305 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 306 | // Confidentiality Algorithm Interface for the Session |
| 307 | std::unique_ptr<cipher::crypt::Interface> cryptAlgoInterface = nullptr; |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 308 | |
Vernon Mauery | 9e801a2 | 2018-10-12 13:20:49 -0700 | [diff] [blame] | 309 | // Last Transaction Time |
| 310 | decltype(std::chrono::steady_clock::now()) lastTime; |
Tom Joseph | f0ca513 | 2016-08-09 08:16:12 -0500 | [diff] [blame] | 311 | }; |
| 312 | |
| 313 | } // namespace session |