pana_paa_factory.cxx

/* BEGIN_COPYRIGHT                                                        */
/*                                                                        */
/* Open Diameter: Open-source software for the Diameter and               */
/*                Diameter related protocols                              */
/*                                                                        */
/* Copyright (C) 2002-2004 Open Diameter Project                          */
/*                                                                        */
/* This library is free software; you can redistribute it and/or modify   */
/* it under the terms of the GNU Lesser General Public License as         */
/* published by the Free Software Foundation; either version 2.1 of the   */
/* License, or (at your option) any later version.                        */
/*                                                                        */
/* This library is distributed in the hope that it will be useful,        */
/* but WITHOUT ANY WARRANTY; without even the implied warranty of         */
/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU      */
/* Lesser General Public License for more details.                        */
/*                                                                        */
/* You should have received a copy of the GNU Lesser General Public       */
/* License along with this library; if not, write to the Free Software    */
/* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307    */
/* USA.                                                                   */
/*                                                                        */
/* In addition, when you copy and redistribute some or the entire part of */
/* the source code of this software with or without modification, you     */
/* MUST include this copyright notice in each copy.                       */
/*                                                                        */
/* If you make any changes that are appeared to be useful, please send    */
/* sources that include the changed part to                               */
/* diameter-developers@lists.sourceforge.net so that we can reflect your  */
/* changes to one unified version of this software.                       */
/*                                                                        */
/* END_COPYRIGHT                                                          */

#include "pana_session.h"
#include "pana_paa_factory.h"
#include "pana_database.h"
#include "pana_cookie.h"
#include "pana_serial_num.h"
#include "pana_config_manager.h"
#include "pana_sid_generator.h"

void PANA_PaaSessionFactory::Receive(PANA_Message &msg)
{
   // first level validation
   AAAAvpContainer* c_sessionId = msg.avpList().search("Session-Id");
   if (! c_sessionId) {
      if (msg.flags().request) {
         throw (PANA_Exception(PANA_Exception::INVALID_MESSAGE, 
                            "server received invalid request message"));
      }
      switch (msg.type()) {
         case PANA_MTYPE_DISCOVER: ReceiveDiscover(msg);    break;
         case PANA_MTYPE_START:    ReceiveStartAnswer(msg); break;
         default:
            throw (PANA_Exception(PANA_Exception::ENTRY_NOT_FOUND, 
                                 "Session Id AVP not found in packet, discarding message"));
      }
      return;
   }
   diameter_utf8string_t &sessionId = (*c_sessionId)
             [0]->dataRef(Type2Type<diameter_utf8string_t>());

   // session lookup and message reception
   PANA_PaaSession *session = PANA_SESSIONDB_SEARCH(sessionId);
   if (session) {
      session->Receive(msg);
      return;
   }
   throw (PANA_Exception(PANA_Exception::ENTRY_NOT_FOUND, 
                        "Session not found in the database, discarding message"));
}

void PANA_PaaSessionFactory::Error(int err)
{
    ACE_DEBUG((LM_INFO, "(%P|%t) Server receive error handler, error=%s\n", 
               ACE_OS_String::strerror(err)));

    // TBD:: recurse through entire tree and submitt error
}

void PANA_PaaSessionFactory::ReceiveDiscover(PANA_Message &msg)
{
   /* Draft 2 notes:

       PaC      PAA         Message 
       ------------------------------------------------------ 
       ----->            PANA-PAA-Discover(0,0) 
       <-----            PANA-Start-Request(x,0)[Cookie] 
       ----->            PANA-Start-Answer(x,y)[ Cookie] 
                         (continued to authentication phase) 
   */

   // validate sequence number
   if (msg.tseq() != 0 || msg.rseq() != 0) {
      throw (PANA_Exception(PANA_Exception::INVALID_MESSAGE, 
                           "Rseq or Tseq field of discover message is non-zero"));
   }

   PANA_DeviceId *ipId = msg.srcDevices().search(PANA_DeviceId::IPV4_ADDRESS);
   if (ipId == NULL) {
       throw (PANA_Exception(PANA_Exception::INVALID_MESSAGE, 
              "Cannot determine the device ID of peer"));
   }
   
   // extract device id if any and verify
   AAAAvpContainer *c_deviceId = msg.avpList().search("Device-Id");
   if (c_deviceId) {
       PANA_TVData_t &deviceId = (*c_deviceId)[0]->dataRef
           (Type2Type<PANA_TVData_t>());
       if (deviceId.type == ipId->type()) {
           if (ACE_OS::memcmp(deviceId.value.data(), ipId->id().data(),
                              deviceId.value.size())) {
              throw (PANA_Exception(PANA_Exception::INVALID_MESSAGE, 
                     "Device ID AVP value does not match device id of packet"));
           }
       }
   }

   if (PANA_CONFIG_AUTHAGENT().use_cookie_) {
       
       ACE_DEBUG((LM_INFO, "(%P|%t) RECV: Discover [stateless], S-flag %d, tseq=%d, rseq=%d\n",
                 msg.flags().separate, msg.tseq(), msg.rseq()));

       // generate cookie
       diameter_octetstring_t cookie;
       PANA_COOKIE_GENERATE(const_cast<std::string&>(ipId->id()),
                            cookie);

       SendStartRequest(msg, cookie);
   }
   else {
       
       // create and add a new session and add
       // to pending database use the device ID
       // as initial index
       PANA_PaaSession *session = Create();
       if (session == NULL) {
          throw (PANA_Exception(PANA_Exception::NO_MEMORY, 
                               "Failed to auth agent session"));
       }

       ACE_DEBUG((LM_INFO, "(%P|%t) New session created [stateful discovery]\n"));
   
       m_PendingDb.Add(const_cast<std::string&>(ipId->id()),
                       *session);
       session->Receive(msg);
   }
}

void PANA_PaaSessionFactory::SendStartRequest(PANA_Message &discover, 
                                       diameter_octetstring_t &cookie)
{
   /*    
      A PANA-Start-Request message MAY carry a Cookie AVP that contains a
      cookie.  The rseq field of the header is set to zero (0).  The tseq
      field of the header contains the initial sequence number.  The cookie
      is used for preventing the PAA from resource consumption DoS attacks
      by blind attackers. The cookie is computed in such a way that it does
      not require any per-session state maintenance on the PAA in order to
      verify the cookie returned in a PANA-Start-Answer message. The exact
      algorithms and syntax used for generating cookies does not affect
      interoperability and hence is not specified here.  An example
      algorithm is described below.

      Cookie =
        <secret-version> | HMAC_SHA1( <Device-Id of PaC> | <secret> )

      where <secret> is a randomly generated secret known only to the PAA,
      <secret-version> is an index used for choosing the secret for
      generating the cookie and '|' indicates concatenation.  The secret-
      version should be changed frequently enough to prevent replay
      attacks. The secret key is locally known to the PAA only and valid
      for a certain time frame.

      PAA MAY enable NAP-ISP authentication separation by setting the
      S-flag of the message header of the PANA-Start-Request. Also, the
      PANA-Start-Request MAY contain zero or one NAP-Information AVP and
      zero or more ISP-Information AVPs to advertise the information on the
      NAP and/or ISPs.

       9.3.3 PANA-Start-Request (PSR)

         PANA-Start-Request (PSR) is sent by the PAA to the PaC. The PAA sets
         the transmission sequence number to an initial random value.  The
         received sequence number is set to zero (0).

              PANA-Start-Request ::= < PANA-Header: 2, REQ [SEP] >
                            [ Cookie ]
                            [ EAP-Payload ]
                            [ NAP-Information ]
                         *  [ ISP-Information ]
                         *  [ AVP ]
    */

   AAAAvpContainerManager cm;
   AAAAvpContainerEntryManager em;
   PANA_Message *msg;

   ACE_NEW_NORETURN(msg, PANA_Message);
   if (msg == NULL) {
      throw (PANA_Exception(PANA_Exception::NO_MEMORY, 
                            "Failed to allocate msg message"));
   }

   // Populate header
   PANA_MsgHeader::Flags flg = { 1, 0, 0, 0 };
   msg->flags(flg);
   msg->type(PANA_MTYPE_START);
   msg->tseq(PANA_SerialNumber::generateIsn());
   msg->rseq(0);

   // Calculate S-flag
   msg->flags().separate = PANA_CONFIG_AUTHAGENT().s_flag_;

   // Populate Cookie AVP if necessary
   AAAAvpContainerEntry *e;
   if (cookie.size() > 0) {

      AAAAvpContainer *c_cookie = cm.acquire("Cookie");

      // Add the AVP's to containers
      e = em.acquire(AAA_AVPDataType(AAA_AVP_STRING_TYPE));
      diameter_octetstring_t &ck = e->dataRef(Type2Type<diameter_octetstring_t>());
      c_cookie->add(e);

      // Add containers to list
      msg->avpList().add(c_cookie);

      // Populate cookie
      ck.assign(cookie.data(), cookie.size());
   }
   else {
      throw (PANA_Exception(PANA_Exception::NO_MEMORY, 
                            "Invalid cookie generated"));
   }

   // Populate NAP-Information 
   PANA_ProviderInfoTool infoTool;
   PANA_CfgProviderInfo *pInfo = &PANA_CONFIG_AUTHAGENT().nap_info_;
   if (pInfo->name_.length() > 0) {

      // Add the AVP's to containers
      AAAAvpContainer *c_napInfo = cm.acquire("NAP-Information");        
      e = em.acquire(AAA_AVP_GROUPED_TYPE);
      diameter_grouped_t &napInfo = e->dataRef(Type2Type<diameter_grouped_t>());
      c_napInfo->add(e);

      // Add containers to list and populate
      msg->avpList().add(c_napInfo);
      infoTool.Add(napInfo, *pInfo);
   }
   else {
      throw (PANA_Exception(PANA_Exception::NO_MEMORY, 
                            "NAP Information missing"));
   }

   // See if there is also ISP-Info
   PANA_CfgProviderList &ispList = PANA_CONFIG_AUTHAGENT().isp_info_;
   if (ispList.size() > 0) {

      // Add containers to message
      AAAAvpContainer *c_ispInfo = cm.acquire("ISP-Information");        
      msg->avpList().add(c_ispInfo);

      PANA_CfgProviderList::iterator i;
      for (i = ispList.begin(); i != ispList.end(); i ++) {

         pInfo = (*i);

         // Add the AVP's to containers
         e = em.acquire(AAA_AVP_GROUPED_TYPE);
         diameter_grouped_t &ispInfo = e->dataRef(Type2Type<diameter_grouped_t>());
         c_ispInfo->add(e);

         // Add containers to list and populate
         PANA_ProviderInfoTool info;
         info.Add(ispInfo, *pInfo);
      }
   }

   // Retrieve source devices and send back to Pac
   PANA_DeviceId *ipId = discover.srcDevices().search(PANA_DeviceId::IPV4_ADDRESS);
   msg->srcDevices().move(discover.srcDevices(), *ipId);

   // Carry over the destination port from source message
   msg->srcPort(discover.srcPort());

   m_UdpChannel.Send(*msg);

   ACE_DEBUG((LM_INFO, "(%P|%t) SEND: Start-Request, tseq=%d, rseq=%d\n",
              msg->tseq(), msg->rseq()));
}

void PANA_PaaSessionFactory::ReceiveStartAnswer(PANA_Message &msg)
{
   /* 
      When the PAA receives the PANA-Start-Answer message from the PaC, it
      verifies the cookie.  The cookie is considered as valid if the
      received cookie has the expected value.  If the computed cookie is
      valid, the protocol enters the authentication phase.  Otherwise, it
      MUST silently discard the received message.

      When a Cookie-AVP is carried in a PANA-Start-Request message, the
      initial EAP Request MUST NOT be carried in the PANA-Start-Request
      message in order for the PAA to be stateless.

      When a Cookie-AVP is not carried in a PANA-Start-Request message, the
      PAA does not need to be stateless.  In this case, the initial EAP
      Request message MAY be carried in the PANA-Start-Request message.

      If the initial EAP Request message is carried in the
      PANA-Start-Request message, an EAP Response message MUST be carried
      in the PANA-Start-Answer message returned to the PAA.

      In any case, PANA MUST NOT generate an EAP message on behalf of EAP
      peer or EAP (pass-through) authenticator.

      The PANA-Start-Request/Answer exchange is needed before entering
      authentication phase even when the PaC is pre-configured with PAAs IP
      address and the PANA-PAA-Discover message is unicast.

      A PANA-Start-Request message is never retransmitted. A
      PANA-Start-Answer message is retransmitted based on timer in the same
      manner as other messages retransmitted at PANA-layer.

      It is possible that both PAA and PaC initiate the discovery and
      initial handshake procedure at the same time, i.e., the PAA sends a
      PANA-Start-Request message while the PaC sends a PANA-PAA-Discover
      message.  To resolve the race condition, the PAA SHOULD silently
      discard the PANA-PAA-Discover message received from the PaC after it
      has sent a PANA-Start-Request message with creating a state for the
      PaC.
   */

   // validate sequence number
   if (msg.tseq() == 0 || msg.rseq() == 0) {
      throw (PANA_Exception(PANA_Exception::INVALID_MESSAGE, 
                           "Rseq or Tseq field of start answer message is zero"));
   }

   ACE_DEBUG((LM_INFO, "(%P|%t) RECV: Start answer [factory], S-flag %d, tseq=%d, rseq=%d\n",
                       msg.flags().separate, msg.tseq(), msg.rseq()));

   PANA_PaaSession *session = NULL;
   if (PANA_CONFIG_AUTHAGENT().use_cookie_) {
       
       PANA_Paa::ValidateCookie(msg);
       
       ACE_DEBUG((LM_INFO, "(%P|%t) Pac validated, creating new session\n"));
       session = Create();
   }
   else {
       PANA_DeviceId *ipId = msg.srcDevices().search(PANA_DeviceId::IPV4_ADDRESS);
       if (ipId == NULL) {
           throw (PANA_Exception(PANA_Exception::INVALID_MESSAGE, 
                  "Cannot determine the device ID of peer"));
       }
       
       ACE_DEBUG((LM_INFO, "(%P|%t) Stateful discovery, updating session\n"));
       m_PendingDb.Remove(const_cast<std::string&>(ipId->id()),
                          &session);
   }   
       
   if (session == NULL) {
      throw (PANA_Exception(PANA_Exception::NO_MEMORY, 
                            "Failed to auth agent session"));
   }
   
   // generate a new session id 
   diameter_octetstring_t sessionId;
   PANA_SessionIdGenerator_S::instance()->Generate(sessionId);

   PANA_SESSIONDB_ADD(sessionId, *session);

   // tag the session id temporarily
   AAAAvpContainerManager cm;
   AAAAvpContainerEntryManager em;
   AAAAvpContainer *c_sessionId = cm.acquire("Session-Id");

   // Add the AVP's to containers
   AAAAvpContainerEntry *e = em.acquire(AAA_AVP_UTF8_STRING_TYPE);
   diameter_utf8string_t &sid = e->dataRef(Type2Type<diameter_utf8string_t>());
   c_sessionId->add(e);

   msg.avpList().add(c_sessionId);
   sid = sessionId;

   session->Receive(msg);
}

---