/*

 * Copyright (c) 2003 Sun Microsystems, Inc.  All Rights Reserved.

 * 

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 

 * Redistribution of source code must retain the above copyright

 * notice, this list of conditions and the following disclaimer.

 * 

 * Redistribution in binary form must reproduce the above copyright

 * notice, this list of conditions and the following disclaimer in the

 * documentation and/or other materials provided with the distribution.

 * 

 * Neither the name of Sun Microsystems, Inc. or the names of

 * contributors may be used to endorse or promote products derived

 * from this software without specific prior written permission.

 * 

 * This software is provided "AS IS," without a warranty of any kind.

 * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES,

 * INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A

 * PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY EXCLUDED.

 * SUN MICROSYSTEMS, INC. ("SUN") AND ITS LICENSORS SHALL NOT BE LIABLE

 * FOR ANY DAMAGES SUFFERED BY LICENSEE AS A RESULT OF USING, MODIFYING

 * OR DISTRIBUTING THIS SOFTWARE OR ITS DERIVATIVES.  IN NO EVENT WILL

 * SUN OR ITS LICENSORS BE LIABLE FOR ANY LOST REVENUE, PROFIT OR DATA,

 * OR FOR DIRECT, INDIRECT, SPECIAL, CONSEQUENTIAL, INCIDENTAL OR

 * PUNITIVE DAMAGES, HOWEVER CAUSED AND REGARDLESS OF THE THEORY OF

 * LIABILITY, ARISING OUT OF THE USE OF OR INABILITY TO USE THIS SOFTWARE,

 * EVEN IF SUN HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

 */

#define _GNU_SOURCE

#include <stdlib.h>

#include <stdio.h>

#include <inttypes.h>

#include <string.h>

#include <sys/time.h>

#include <sys/types.h>

#include <sys/select.h>

#include <sys/socket.h>

#include <netinet/in.h>

#include <arpa/inet.h>

#include <errno.h>

#include <unistd.h>

#include <netdb.h>

#include <time.h>

#include <fcntl.h>

#include <assert.h>

#ifdef HAVE_CONFIG_H

# include <config.h>

#endif

#include <ipmitool/helper.h>

#include <ipmitool/log.h>

#include <ipmitool/ipmi.h>

#include <ipmitool/ipmi_lanp.h>

#include <ipmitool/ipmi_channel.h>

#include <ipmitool/ipmi_intf.h>

#include <ipmitool/ipmi_sel.h>

#include <ipmitool/ipmi_strings.h>

#include <ipmitool/hpm2.h>

#include <ipmitool/bswap.h>

#include <openssl/rand.h>

#include "lanplus.h"

#include "lanplus_crypt.h"

#include "lanplus_crypt_impl.h"

#include "lanplus_dump.h"

#include "rmcp.h"

#include "asf.h"

/*

 * LAN interface is required to support 45 byte request transactions and

 * 42 byte response transactions.

 */

#define IPMI_LAN_MAX_REQUEST_SIZE	38	/* 45 - 7 */

#define IPMI_LAN_MAX_RESPONSE_SIZE	34	/* 42 - 8 */

extern const struct valstr ipmi_rakp_return_codes[];

extern const struct valstr ipmi_priv_levels[];

extern const struct valstr ipmi_auth_algorithms[];

extern const struct valstr ipmi_integrity_algorithms[];

extern const struct valstr ipmi_encryption_algorithms[];

static struct ipmi_rq_entry * ipmi_req_entries;

static struct ipmi_rq_entry * ipmi_req_entries_tail;

static int ipmi_lanplus_setup(struct ipmi_intf * intf);

static int ipmi_lanplus_keepalive(struct ipmi_intf * intf);

static int ipmi_lan_send_packet(struct ipmi_intf * intf, uint8_t * data, int data_len);

static struct ipmi_rs * ipmi_lan_recv_packet(struct ipmi_intf * intf);

static struct ipmi_rs * ipmi_lan_poll_recv(struct ipmi_intf * intf);

static struct ipmi_rs * ipmi_lanplus_send_ipmi_cmd(struct ipmi_intf * intf, struct ipmi_rq * req);

static struct ipmi_rs * ipmi_lanplus_send_payload(struct ipmi_intf * intf,

												  struct ipmi_v2_payload * payload);

static void getIpmiPayloadWireRep(

								  struct ipmi_intf       * intf,

								  struct ipmi_v2_payload * payload,  /* in  */

								  uint8_t  * out,

								  struct ipmi_rq * req,

								  uint8_t    rq_seq,

								  uint8_t curr_seq);

static void getSolPayloadWireRep(

								  struct ipmi_intf       * intf,

								 uint8_t          * msg,

								 struct ipmi_v2_payload * payload);

static void read_open_session_response(struct ipmi_rs * rsp, int offset);

static void read_rakp2_message(struct ipmi_rs * rsp, int offset, uint8_t alg);

static void read_rakp4_message(struct ipmi_rs * rsp, int offset, uint8_t alg);

static void read_session_data(struct ipmi_rs * rsp, int * offset, struct ipmi_session *s);

static void read_session_data_v15(struct ipmi_rs * rsp, int * offset, struct ipmi_session *s);

static void read_session_data_v2x(struct ipmi_rs * rsp, int * offset, struct ipmi_session *s);

static void read_ipmi_response(struct ipmi_rs * rsp, int * offset);

static void read_sol_packet(struct ipmi_rs * rsp, int * offset);

static struct ipmi_rs * ipmi_lanplus_recv_sol(struct ipmi_intf * intf);

static struct ipmi_rs * ipmi_lanplus_send_sol(

											  struct ipmi_intf * intf,

											  struct ipmi_v2_payload * payload);

static int check_sol_packet_for_new_data(

									 struct ipmi_intf * intf,

									 struct ipmi_rs *rsp);

static void ack_sol_packet(

							struct ipmi_intf * intf,

							struct ipmi_rs * rsp);

static void ipmi_lanp_set_max_rq_data_size(struct ipmi_intf * intf, uint16_t size);

static void ipmi_lanp_set_max_rp_data_size(struct ipmi_intf * intf, uint16_t size);

static uint8_t bridgePossible = 0;

struct ipmi_intf ipmi_lanplus_intf = {

	.name = "lanplus",

	.desc = "IPMI v2.0 RMCP+ LAN Interface",

	.setup = ipmi_lanplus_setup,

	.open = ipmi_lanplus_open,

	.close = ipmi_lanplus_close,

	.sendrecv = ipmi_lanplus_send_ipmi_cmd,

	.recv_sol = ipmi_lanplus_recv_sol,

	.send_sol = ipmi_lanplus_send_sol,

	.keepalive = ipmi_lanplus_keepalive,

	.set_max_request_data_size = ipmi_lanp_set_max_rq_data_size,

	.set_max_response_data_size = ipmi_lanp_set_max_rp_data_size,

	.target_addr = IPMI_BMC_SLAVE_ADDR,

};

extern int verbose;

/*

 * lanplus_get_requested_ciphers

 *

 * Set the authentication, integrity and encryption algorithms based

 * on the cipher suite ID.  See table 22-19 in the IPMIv2 spec for the

 * source of this information.

 *

 * param cipher_suite_id [in]

 * param auth_alg        [out]

 * param integrity_alg   [out]

 * param crypt_alg       [out]

 *

 * returns 0 on success

 *         1 on failure

 */

int lanplus_get_requested_ciphers(enum cipher_suite_ids cipher_suite_id,

								  uint8_t * auth_alg,

								  uint8_t * integrity_alg,

								  uint8_t * crypt_alg)

{

		/* See table 22-19 for the source of the statement */

	switch (cipher_suite_id)

	{

	case IPMI_LANPLUS_CIPHER_SUITE_0:

		*auth_alg      = IPMI_AUTH_RAKP_NONE;

		*integrity_alg = IPMI_INTEGRITY_NONE;

		*crypt_alg     = IPMI_CRYPT_NONE;

		break;

	case IPMI_LANPLUS_CIPHER_SUITE_1:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_SHA1;

		*integrity_alg = IPMI_INTEGRITY_NONE;

		*crypt_alg     = IPMI_CRYPT_NONE;

		break;

	case IPMI_LANPLUS_CIPHER_SUITE_2:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_SHA1;

		*integrity_alg = IPMI_INTEGRITY_HMAC_SHA1_96;

		*crypt_alg     = IPMI_CRYPT_NONE;

		break;

	case IPMI_LANPLUS_CIPHER_SUITE_3:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_SHA1;

		*integrity_alg = IPMI_INTEGRITY_HMAC_SHA1_96;

		*crypt_alg     = IPMI_CRYPT_AES_CBC_128;

		break;

	case IPMI_LANPLUS_CIPHER_SUITE_4:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_SHA1;

		*integrity_alg = IPMI_INTEGRITY_HMAC_SHA1_96;

		*crypt_alg     = IPMI_CRYPT_XRC4_128;

		break;

	case IPMI_LANPLUS_CIPHER_SUITE_5:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_SHA1;

		*integrity_alg = IPMI_INTEGRITY_HMAC_SHA1_96;

		*crypt_alg     = IPMI_CRYPT_XRC4_40;

		break;

	case IPMI_LANPLUS_CIPHER_SUITE_6:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_MD5;

		*integrity_alg = IPMI_INTEGRITY_NONE;

		*crypt_alg     = IPMI_CRYPT_NONE;

		break;

	case IPMI_LANPLUS_CIPHER_SUITE_7:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_MD5;

		*integrity_alg = IPMI_INTEGRITY_HMAC_MD5_128;

		*crypt_alg     = IPMI_CRYPT_NONE;

		break;

	case IPMI_LANPLUS_CIPHER_SUITE_8:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_MD5;

		*integrity_alg = IPMI_INTEGRITY_HMAC_MD5_128;

		*crypt_alg     = IPMI_CRYPT_AES_CBC_128;

		break;

	case IPMI_LANPLUS_CIPHER_SUITE_9:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_MD5;

		*integrity_alg = IPMI_INTEGRITY_HMAC_MD5_128;

		*crypt_alg     = IPMI_CRYPT_XRC4_128;

		break;

	case IPMI_LANPLUS_CIPHER_SUITE_10:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_MD5;

		*integrity_alg = IPMI_INTEGRITY_HMAC_MD5_128;

		*crypt_alg     = IPMI_CRYPT_XRC4_40;

		break;

	case IPMI_LANPLUS_CIPHER_SUITE_11:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_MD5;

		*integrity_alg = IPMI_INTEGRITY_MD5_128;

		*crypt_alg     = IPMI_CRYPT_NONE;

		break;

	case IPMI_LANPLUS_CIPHER_SUITE_12:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_MD5;

		*integrity_alg = IPMI_INTEGRITY_MD5_128;

		*crypt_alg     = IPMI_CRYPT_AES_CBC_128;

		break;

	case IPMI_LANPLUS_CIPHER_SUITE_13:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_MD5;

		*integrity_alg = IPMI_INTEGRITY_MD5_128;

		*crypt_alg     = IPMI_CRYPT_XRC4_128;

		break;

	case IPMI_LANPLUS_CIPHER_SUITE_14:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_MD5;

		*integrity_alg = IPMI_INTEGRITY_MD5_128;

		*crypt_alg     = IPMI_CRYPT_XRC4_40;

		break;

#ifdef HAVE_CRYPTO_SHA256

	case IPMI_LANPLUS_CIPHER_SUITE_15:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_SHA256;

		*integrity_alg = IPMI_INTEGRITY_NONE;

		*crypt_alg     = IPMI_CRYPT_NONE;

		break;

	case IPMI_LANPLUS_CIPHER_SUITE_16:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_SHA256;

		*integrity_alg = IPMI_INTEGRITY_HMAC_SHA256_128;

		*crypt_alg     = IPMI_CRYPT_NONE;

		break;

	case IPMI_LANPLUS_CIPHER_SUITE_17:

		*auth_alg      = IPMI_AUTH_RAKP_HMAC_SHA256;

		*integrity_alg = IPMI_INTEGRITY_HMAC_SHA256_128;

		*crypt_alg     = IPMI_CRYPT_AES_CBC_128;

		break;

#endif /* HAVE_CRYPTO_SHA256 */

	case IPMI_LANPLUS_CIPHER_SUITE_RESERVED:

	default:

		return 1;

	}

	return 0;

}

/*

 * Reverse the order of arbitrarily long strings of bytes

 */

void lanplus_swap(

				  uint8_t * buffer,

						int             length)

{

	int i;

	uint8_t temp;

	for (i =0; i < length/2; ++i)

	{

		temp = buffer[i];

		buffer[i] = buffer[length - 1 - i];

		buffer[length - 1 - i] = temp;

	}

}

static const struct valstr plus_payload_types_vals[] = {

	 { IPMI_PAYLOAD_TYPE_IPMI,              "IPMI (0)" },	// IPMI Message

	 { IPMI_PAYLOAD_TYPE_SOL,               "SOL  (1)" },	// SOL (Serial over LAN)

	 { IPMI_PAYLOAD_TYPE_OEM,               "OEM  (2)" },	// OEM Explicid

	 { IPMI_PAYLOAD_TYPE_RMCP_OPEN_REQUEST, "OpenSession Req (0x10)" },

	 { IPMI_PAYLOAD_TYPE_RMCP_OPEN_RESPONSE,"OpenSession Resp (0x11)" },

	 { IPMI_PAYLOAD_TYPE_RAKP_1,            "RAKP1 (0x12)" },

	 { IPMI_PAYLOAD_TYPE_RAKP_2,            "RAKP2 (0x13)" },

	 { IPMI_PAYLOAD_TYPE_RAKP_3,            "RAKP3 (0x14)" },

	 { IPMI_PAYLOAD_TYPE_RAKP_4,            "RAKP4 (0x15)" },

	{ 0x00, NULL },

};

static struct ipmi_rq_entry *

ipmi_req_add_entry(struct ipmi_intf * intf, struct ipmi_rq * req, uint8_t req_seq)

{

	struct ipmi_rq_entry * e;

	e = malloc(sizeof(struct ipmi_rq_entry));

	if (e == NULL) {

		lprintf(LOG_ERR, "ipmitool: malloc failure");

		return NULL;

	}

	memset(e, 0, sizeof(struct ipmi_rq_entry));

	memcpy(&e->req, req, sizeof(struct ipmi_rq));

	e->intf = intf;

	e->rq_seq = req_seq;

	if (ipmi_req_entries == NULL)

		ipmi_req_entries = e;

	else

		ipmi_req_entries_tail->next = e;

	ipmi_req_entries_tail = e;

	lprintf(LOG_DEBUG+3, "added list entry seq=0x%02x cmd=0x%02x",

		e->rq_seq, e->req.msg.cmd);     

	return e;

}

static struct ipmi_rq_entry *

ipmi_req_lookup_entry(uint8_t seq, uint8_t cmd)

{

	struct ipmi_rq_entry * e = ipmi_req_entries;

	while (e && (e->rq_seq != seq || e->req.msg.cmd != cmd)) {

		if (e == e->next)

			return NULL;

		e = e->next;

	}

	return e;

}

static void

ipmi_req_remove_entry(uint8_t seq, uint8_t cmd)

{

	struct ipmi_rq_entry * p, * e, * saved_next_entry;

	e = p = ipmi_req_entries;

	while (e && (e->rq_seq != seq || e->req.msg.cmd != cmd)) {

		p = e;

		e = e->next;

	}

	if (e) {

		lprintf(LOG_DEBUG+3, "removed list entry seq=0x%02x cmd=0x%02x",

			seq, cmd);

		saved_next_entry = e->next;

		p->next = (p->next == e->next) ? NULL : e->next;

		/* If entry being removed is first in list, fix up list head */

		if (ipmi_req_entries == e) {

			if (ipmi_req_entries != p)

				ipmi_req_entries = p;

			else

				ipmi_req_entries = saved_next_entry;

		}

		/* If entry being removed is last in list, fix up list tail */

		if (ipmi_req_entries_tail == e) {

			if (ipmi_req_entries_tail != p)

				ipmi_req_entries_tail = p;

			else

				ipmi_req_entries_tail = NULL;

		}

		if (e->msg_data) {

			free(e->msg_data);

			e->msg_data = NULL;

		}

		free(e);

		e = NULL;

	}

}

static void

ipmi_req_clear_entries(void)

{

	struct ipmi_rq_entry * p, * e;

	e = ipmi_req_entries;

	while (e) {

		lprintf(LOG_DEBUG+3, "cleared list entry seq=0x%02x cmd=0x%02x",

			e->rq_seq, e->req.msg.cmd);

		p = e->next;

		free(e);

		e = p;

	}

	ipmi_req_entries = NULL;

	ipmi_req_entries_tail = NULL;

}

int

ipmi_lan_send_packet(

					 struct ipmi_intf * intf,

					 uint8_t * data, int

					 data_len)

{

	if (verbose >= 5)

		printbuf(data, data_len, ">> sending packet");

	return send(intf->fd, data, data_len, 0);

}

struct ipmi_rs *

ipmi_lan_recv_packet(struct ipmi_intf * intf)

{

	static struct ipmi_rs rsp;

	fd_set read_set, err_set;

	struct timeval tmout;

	int ret;

	FD_ZERO(&read_set);

	FD_SET(intf->fd, &read_set);

	FD_ZERO(&err_set);

	FD_SET(intf->fd, &err_set);

	tmout.tv_sec = intf->session->timeout;

	tmout.tv_usec = 0;

	ret = select(intf->fd + 1, &read_set, NULL, &err_set, &tmout);

	if (ret < 0 || FD_ISSET(intf->fd, &err_set) || !FD_ISSET(intf->fd, &read_set))

		return NULL;

	/* the first read may return ECONNREFUSED because the rmcp ping

	 * packet--sent to UDP port 623--will be processed by both the

	 * BMC and the OS.

	 *

	 * The problem with this is that the ECONNREFUSED takes

	 * priority over any other received datagram; that means that

	 * the Connection Refused shows up _before_ the response packet,

	 * regardless of the order they were sent out.  (unless the

	 * response is read before the connection refused is returned)

	 */

	ret = recv(intf->fd, &rsp.data, IPMI_BUF_SIZE, 0);

	if (ret < 0) {

		FD_ZERO(&read_set);

		FD_SET(intf->fd, &read_set);

		FD_ZERO(&err_set);

		FD_SET(intf->fd, &err_set);

		tmout.tv_sec = intf->session->timeout;

		tmout.tv_usec = 0;

		ret = select(intf->fd + 1, &read_set, NULL, &err_set, &tmout);

		if (ret < 0 || FD_ISSET(intf->fd, &err_set) || !FD_ISSET(intf->fd, &read_set))

			return NULL;

		ret = recv(intf->fd, &rsp.data, IPMI_BUF_SIZE, 0);

		if (ret < 0)

			return NULL;

	}

	if (ret == 0)

		return NULL;

	rsp.data[ret] = '\0';

	rsp.data_len = ret;

	if (verbose >= 5)

		printbuf(rsp.data, rsp.data_len, "<< received packet");

	return &rsp;

}

/*

 * parse response RMCP "pong" packet

 *

 * return -1 if ping response not received

 * returns 0 if IPMI is NOT supported

 * returns 1 if IPMI is supported

 *

 * udp.source	= 0x026f	// RMCP_UDP_PORT

 * udp.dest	= ?		// udp.source from rmcp-ping

 * udp.len	= ?

 * udp.check	= ?

 * rmcp.ver	= 0x06		// RMCP Version 1.0

 * rmcp.__res	= 0x00		// RESERVED

 * rmcp.seq	= 0xff		// no RMCP ACK

 * rmcp.class	= 0x06		// RMCP_CLASS_ASF

 * asf.iana	= 0x000011be	// ASF_RMCP_IANA

 * asf.type	= 0x40		// ASF_TYPE_PONG

 * asf.tag	= ?		// asf.tag from rmcp-ping

 * asf.__res	= 0x00		// RESERVED

 * asf.len	= 0x10		// 16 bytes

 * asf.data[3:0]= 0x000011be	// IANA# = RMCP_ASF_IANA if no OEM

 * asf.data[7:4]= 0x00000000	// OEM-defined (not for IPMI)

 * asf.data[8]	= 0x81		// supported entities

 * 				// [7]=IPMI [6:4]=RES [3:0]=ASF_1.0

 * asf.data[9]	= 0x00		// supported interactions (reserved)

 * asf.data[f:a]= 0x000000000000

 */

static int

ipmi_handle_pong(struct ipmi_intf * intf, struct ipmi_rs * rsp)

{

	struct rmcp_pong {

		struct rmcp_hdr rmcp;

		struct asf_hdr asf;

		uint32_t iana;

		uint32_t oem;

		uint8_t sup_entities;

		uint8_t sup_interact;

		uint8_t reserved[6];

	} * pong;

	if (!rsp)

		return -1;

	pong = (struct rmcp_pong *)rsp->data;

	if (verbose)

		printf("Received IPMI/RMCP response packet: "

				"IPMI%s Supported\n",

				(pong->sup_entities & 0x80) ? "" : " NOT");

	if (verbose > 1)

		printf("  ASF Version %s\n"

				"  RMCP Version %s\n"

				"  RMCP Sequence %d\n"

				"  IANA Enterprise %lu\n\n",

				(pong->sup_entities & 0x01) ? "1.0" : "unknown",

				(pong->rmcp.ver == 6) ? "1.0" : "unknown",

				pong->rmcp.seq,

				(unsigned long)ntohl(pong->iana));

	return (pong->sup_entities & 0x80) ? 1 : 0;

}

/* build and send RMCP presence ping packet

 *

 * RMCP ping

 *

 * udp.source	= ?

 * udp.dest	= 0x026f	// RMCP_UDP_PORT

 * udp.len	= ?

 * udp.check	= ?

 * rmcp.ver	= 0x06		// RMCP Version 1.0

 * rmcp.__res	= 0x00		// RESERVED

 * rmcp.seq	= 0xff		// no RMCP ACK

 * rmcp.class	= 0x06		// RMCP_CLASS_ASF

 * asf.iana	= 0x000011be	// ASF_RMCP_IANA

 * asf.type	= 0x80		// ASF_TYPE_PING

 * asf.tag	= ?		// ASF sequence number

 * asf.__res	= 0x00		// RESERVED

 * asf.len	= 0x00

 *

 */

int

ipmiv2_lan_ping(struct ipmi_intf * intf)

{

	struct asf_hdr asf_ping = {

		.iana	= htonl(ASF_RMCP_IANA),

		.type	= ASF_TYPE_PING,

	};

	struct rmcp_hdr rmcp_ping = {

		.ver	= RMCP_VERSION_1,

		.class	= RMCP_CLASS_ASF,

		.seq	= 0xff,

	};

	uint8_t * data;

	int len = sizeof(rmcp_ping) + sizeof(asf_ping);

	int rv;

	data = malloc(len);

	if (data == NULL) {

		lprintf(LOG_ERR, "ipmitool: malloc failure");

		return -1;

	}

	memset(data, 0, len);

	memcpy(data, &rmcp_ping, sizeof(rmcp_ping));

	memcpy(data+sizeof(rmcp_ping), &asf_ping, sizeof(asf_ping));

	lprintf(LOG_DEBUG, "Sending IPMI/RMCP presence ping packet");

	rv = ipmi_lan_send_packet(intf, data, len);

	free(data);

	data = NULL;

	if (rv < 0) {

		lprintf(LOG_ERR, "Unable to send IPMI presence ping packet");

		return -1;

	}

	if (ipmi_lan_poll_recv(intf) == 0)

		return 0;

	return 1;

}

/**

 *

 * ipmi_lan_poll_single

 *

 * Receive whatever comes back.  Ignore received packets that don't correspond

 * to a request we've sent.

 *

 * Returns: the ipmi_rs packet describing the/a response we expect.

 */

static struct ipmi_rs *

ipmi_lan_poll_single(struct ipmi_intf * intf)

{

	struct rmcp_hdr * rmcp_rsp;

	struct ipmi_rs * rsp;

	struct ipmi_session * session = intf->session;

	int offset, rv;

	uint16_t payload_size;

	/* receive packet */

	rsp = ipmi_lan_recv_packet(intf);

	/* check if no packet has come */

	if (rsp == NULL) {

		return NULL;

	}

	/* parse response headers */

	rmcp_rsp = (struct rmcp_hdr *)rsp->data;

	if (rmcp_rsp->class == RMCP_CLASS_ASF) {

		/* might be ping response packet */

		rv = ipmi_handle_pong(intf, rsp);

		return (rv <= 0) ? NULL : rsp;

	}

	if (rmcp_rsp->class != RMCP_CLASS_IPMI) {

		lprintf(LOG_DEBUG, "Invalid RMCP class: %x", rmcp_rsp->class);

		/* read one more packet */

		return (struct ipmi_rs *)1;

	}

	/*

	 * The authtype / payload type determines what we are receiving

	 */

	offset = 4;

	/*--------------------------------------------------------------------

	 *

	 * The current packet could be one of several things:

	 *

	 * 1) An IPMI 1.5 packet (the response to our GET CHANNEL

	 *    AUTHENTICATION CAPABILITIES request)

	 * 2) An RMCP+ message with an IPMI response payload

	 * 3) AN RMCP+ open session response

	 * 4) An RAKP-2 message (response to an RAKP 1 message)

	 * 5) An RAKP-4 message (response to an RAKP 3 message)

	 * 6) A Serial Over LAN packet

	 * 7) An Invalid packet (one that doesn't match a request)

	 * -------------------------------------------------------------------

	 */

	read_session_data(rsp, &offset, intf->session);

	/*

	 * Skip packets that are not intended for this session

	 */

	if ((session->v2_data.session_state == LANPLUS_STATE_ACTIVE)    &&

		 (rsp->session.authtype == IPMI_SESSION_AUTHTYPE_RMCP_PLUS) &&

		 (rsp->session.id != intf->session->v2_data.console_id))

	{

		lprintf(LOG_INFO, "packet session id 0x%x does not "

			"match active session 0x%0x",

			rsp->session.id, intf->session->v2_data.console_id);

		lprintf(LOG_ERR, "ERROR: Received an Unexpected message ID");

		/* read one more packet */

		return (struct ipmi_rs *)1;

	}

	if (lanplus_has_valid_auth_code(rsp, intf->session) == 0) {

		lprintf(LOG_ERR, "ERROR: Received message with invalid authcode!");

		return NULL;

	}

	if ((session->v2_data.session_state == LANPLUS_STATE_ACTIVE)    &&

			(rsp->session.authtype == IPMI_SESSION_AUTHTYPE_RMCP_PLUS) &&

			(rsp->session.bEncrypted)) {

		lanplus_decrypt_payload(session->v2_data.crypt_alg,

				session->v2_data.k2,

				rsp->data + offset,

				rsp->session.msglen,

				rsp->data + offset,

				&payload_size);

	} else {

		payload_size = rsp->session.msglen;

	}

	/*

	 * Handle IPMI responses (case #1 and #2) -- all IPMI responses

	 */

	if (rsp->session.payloadtype == IPMI_PAYLOAD_TYPE_IPMI) {

		struct ipmi_rq_entry * entry;

		int payload_start = offset;

		int extra_data_length;

		int loop = 1;

		while (loop--) {

			/* fill-in response data */

			read_ipmi_response(rsp, &offset);

			lprintf(LOG_DEBUG+1, "<< IPMI Response Session Header");

			lprintf(LOG_DEBUG+1, "<<   Authtype                : %s",

				val2str(rsp->session.authtype, ipmi_authtype_session_vals));

			lprintf(LOG_DEBUG+1, "<<   Payload type            : %s",

				val2str(rsp->session.payloadtype, plus_payload_types_vals));

			lprintf(LOG_DEBUG+1, "<<   Session ID              : 0x%08lx",

				(long)rsp->session.id);

			lprintf(LOG_DEBUG+1, "<<   Sequence                : 0x%08lx",

				(long)rsp->session.seq);

			lprintf(LOG_DEBUG+1, "<<   IPMI Msg/Payload Length : %d",

				rsp->session.msglen);

			lprintf(LOG_DEBUG+1, "<< IPMI Response Message Header");

			lprintf(LOG_DEBUG+1, "<<   Rq Addr    : %02x",

				rsp->payload.ipmi_response.rq_addr);

			lprintf(LOG_DEBUG+1, "<<   NetFn      : %02x",

				rsp->payload.ipmi_response.netfn);

			lprintf(LOG_DEBUG+1, "<<   Rq LUN     : %01x",

				rsp->payload.ipmi_response.rq_lun);

			lprintf(LOG_DEBUG+1, "<<   Rs Addr    : %02x",

				rsp->payload.ipmi_response.rs_addr);

			lprintf(LOG_DEBUG+1, "<<   Rq Seq     : %02x",

				rsp->payload.ipmi_response.rq_seq);

			lprintf(LOG_DEBUG+1, "<<   Rs Lun     : %01x",

				rsp->payload.ipmi_response.rs_lun);

			lprintf(LOG_DEBUG+1, "<<   Command    : %02x",

				rsp->payload.ipmi_response.cmd);

			lprintf(LOG_DEBUG+1, "<<   Compl Code : 0x%02x",

				rsp->ccode);

			/* Are we expecting this packet? */

			entry = ipmi_req_lookup_entry(rsp->payload.ipmi_response.rq_seq,

								rsp->payload.ipmi_response.cmd);

			if (entry == NULL) {

				lprintf(LOG_INFO, "IPMI Request Match NOT FOUND");

				/* read one more packet */

				return (struct ipmi_rs *)1;

			};

			uint8_t target_cmd = entry->req.msg.target_cmd;

			lprintf(LOG_DEBUG+2, "IPMI Request Match found");

			if (entry->bridging_level) {

				/* Check completion code */

				if (rsp->ccode) {

					lprintf(LOG_DEBUG, "WARNING: Bridged "

							"cmd ccode = 0x%02x", rsp->ccode);

				} else {

					/* decrement bridging level */

					entry->bridging_level--;

					if (!entry->bridging_level) {

						entry->req.msg.cmd = entry->req.msg.target_cmd;

					}

					/* check if bridged response is embedded */

					if (payload_size > 8) {

						printbuf(&rsp->data[offset], (rsp->data_len-offset-1),

								"bridge command response");

						/*

						 * decrement payload size

						 * (cks2 for outer Send Message)

						 */

						payload_size--;

						/*

						 * need to make a loop for embedded bridged response

						 */

						loop++;

					} else {

						lprintf(LOG_DEBUG, "Bridged command answer,"

								" waiting for next answer... ");

						/* read one more packet */

						return (struct ipmi_rs *)1;

					}

				}

			}

			/* Remove request entry */

			ipmi_req_remove_entry(rsp->payload.ipmi_response.rq_seq,

					rsp->payload.ipmi_response.cmd);

			/*

			 * Good packet.  Shift response data to start of array.

			 * rsp->data becomes the variable length IPMI response data

			 * rsp->data_len becomes the length of that data

			 */

			extra_data_length = payload_size - (offset - payload_start) - 1;

			if (extra_data_length) {

				rsp->data_len = extra_data_length;

				memmove(rsp->data, rsp->data + offset, extra_data_length);

			} else {

				rsp->data_len = 0;

			}

		}

	/*

	 * Open Response

	 */

	} else if (rsp->session.payloadtype ==

			IPMI_PAYLOAD_TYPE_RMCP_OPEN_RESPONSE) {

		if (session->v2_data.session_state !=

				LANPLUS_STATE_OPEN_SESSION_SENT) {

			lprintf(LOG_ERR, "Error: Received an Unexpected Open Session "

					"Response");

			/* read one more packet */

			return (struct ipmi_rs *)1;

		}

		read_open_session_response(rsp, offset);

	/*

	 * RAKP 2

	 */

	} else if (rsp->session.payloadtype == IPMI_PAYLOAD_TYPE_RAKP_2) {

		if (session->v2_data.session_state != LANPLUS_STATE_RAKP_1_SENT) {

			lprintf(LOG_ERR, "Error: Received an Unexpected RAKP 2 message");

			/* read one more packet */

			return (struct ipmi_rs *)1;

		}

		read_rakp2_message(rsp, offset, session->v2_data.auth_alg);

	/*

	 * RAKP 4

	 */

	} else if (rsp->session.payloadtype == IPMI_PAYLOAD_TYPE_RAKP_4) {

		if (session->v2_data.session_state != LANPLUS_STATE_RAKP_3_SENT) {

			lprintf(LOG_ERR, "Error: Received an Unexpected RAKP 4 message");

			/* read one more packet */

			return (struct ipmi_rs *)1;

		}

		read_rakp4_message(rsp, offset, session->v2_data.auth_alg);

	/*

	 * SOL

	 */

	} else if (rsp->session.payloadtype == IPMI_PAYLOAD_TYPE_SOL) {

		int payload_start = offset;

		int extra_data_length;

		if (session->v2_data.session_state != LANPLUS_STATE_ACTIVE) {

			lprintf(LOG_ERR, "Error: Received an Unexpected SOL packet");

			/* read one more packet */

			return (struct ipmi_rs *)1;

		}

		read_sol_packet(rsp, &offset);

		extra_data_length = payload_size - (offset - payload_start);

		if (rsp && extra_data_length) {

			rsp->data_len = extra_data_length;

			memmove(rsp->data, rsp->data + offset, extra_data_length);

		} else {

			rsp->data_len = 0;

		}

	/*

	 * Unknown Payload type

	 */