header_fields.go

/*
 Copyright (c) Facebook, Inc. and its affiliates.

 This source code is licensed under the MIT license found in the
 LICENSE file in the root directory of this source tree.
*/

package tacquito

import (
	"encoding/binary"
	"fmt"
	"strings"
)

// constants related to Version
const (
	// MajorVersion is the major TACACS version number.
	MajorVersion = 0xc
	// MinorVersionDefault is TACACS
	MinorVersionDefault = 0x0
	// MinorVersionOne is TACACS+
	MinorVersionOne = 0x1

	// HeaderMaxSequence if reached, connection must terminate and start at 1 again
	HeaderMaxSequence = 255
)

// Version stores MajorVersion and MinorVersion in a single uint8.  The upper 4 bits
// hold major, and the lower 4 bits hold minor.  a uint8 is used to represent both
// at the struct level, but are bitshifted into a single uint8 during MarshalBinary
// and unshifted at UnmarshalBinary
type Version struct {
	MajorVersion uint8
	MinorVersion uint8
}

// Validate known constants
func (v Version) Validate(condition interface{}) error {
	if v.MajorVersion != MajorVersion {
		return fmt.Errorf("invalid MajorVersion: [%v]", v.MajorVersion)
	}

	switch v.MinorVersion {
	case MinorVersionDefault, MinorVersionOne:
		return nil
	default:
		return fmt.Errorf("invalid MinorVersion: [%v]", v.MinorVersion)
	}

}

// Len of Version value.
func (v Version) Len() int {
	// a single uint8
	return 1
}

// String maps Version to string representation.
func (v Version) String() string {
	return fmt.Sprintf("major:%d,minor:%d", v.MajorVersion, v.MinorVersion)
}

// MarshalBinary encodes T into a wire format
func (v *Version) MarshalBinary() ([]byte, error) {
	if err := v.Validate(nil); err != nil {
		return nil, err
	}
	return []byte{v.MajorVersion<<4 | v.MinorVersion}, nil
}

// UnmarshalBinary decodes T from a wire format into struct values
func (v *Version) UnmarshalBinary(data []byte) error {
	v.MajorVersion = data[0] >> 4
	v.MinorVersion = data[0] & 0xf
	return nil
}

// SessionID is the Id for a TACACS+ session.  This field does not change for the
// duration of the TACACS+ session.  This number MUST be generated by a
// cryptographically strong random number generation method.
type SessionID uint32

// MarshalBinary just returns a uint32 in bytes, BigEndian byte order
func (s *SessionID) MarshalBinary() ([]byte, error) {
	sb := make([]byte, 4)
	binary.BigEndian.PutUint32(sb, uint32(*s))
	return sb, nil
}

// UnmarshalBinary populates data parameter with Uint32 in BigEndian byte order
func (s *SessionID) UnmarshalBinary(data []byte) error {
	binary.BigEndian.PutUint32(data, uint32(*s))
	return nil
}

// String converts SessionID to a string
func (s SessionID) String() string {
	return fmt.Sprint(uint32(s))
}

// HeaderType indicates the type of tacacs packet contained in the bytes that follow.
type HeaderType uint8

const (
	// Authenticate per rfc
	Authenticate HeaderType = 0x01
	// Authorize per rfc
	Authorize HeaderType = 0x02
	// Accounting per rfc
	Accounting HeaderType = 0x03
)

// Validate characterics of type based on rfc and usage.
func (t HeaderType) Validate(condition interface{}) error {
	switch t {
	case Authenticate, Authorize, Accounting:
		return nil
	}
	return fmt.Errorf("unknown HeaderType value [%v]", t)
}

// Len returns the length of HeaderType.
func (t HeaderType) Len() int {
	return 1
}

// String returns HeaderType as a string.
func (t HeaderType) String() string {
	switch t {
	case Authenticate:
		return "Authenticate"
	case Authorize:
		return "Authorize"
	case Accounting:
		return "Accounting"
	}
	return fmt.Sprintf("unknown HeaderType[%d]", uint8(t))
}

// SequenceNumber is the sequence number of the current packet.  The first packet
// in a session MUST have the sequence number 1 and each subsequent
// packet will increment the sequence number by one.  Thus clients only
// send packets containing odd sequence numbers, and TACACS+ servers
// only send packets containing even sequence numbers.
//
// The sequence number must never wrap i.e. if the sequence number 2^8-1
// is ever reached, that session must terminate and be restarted with a
// sequence number of 1.
type SequenceNumber uint16

// Len returns the length of SequenceNumber.
func (t SequenceNumber) Len() int {
	return 1
}

// String returns SequenceNumber as a string.
func (t SequenceNumber) String() string {
	return fmt.Sprint(uint8(t))
}

// Inc will return the next seqno as an int
func (t SequenceNumber) Inc() int {
	return int(t) + 1
}

// Validate Sequence Number.
func (t SequenceNumber) Validate(condition interface{}) error {
	switch v := uint16(t); {
	case v < 1:
		return fmt.Errorf("sequence number must be greater than zero, [%v]", t)
	case v > HeaderMaxSequence:
		return fmt.Errorf("headerMaxSequence exceeded [%v]", t)
	}
	return nil
}

// ClientSequenceNumber is used when we want to consider sequences that the client
// sends and validate that they are allowed
type ClientSequenceNumber uint8

// Validate ensures we don't have even sequence numbers from clients
func (t ClientSequenceNumber) Validate(condition interface{}) error {
	switch v := uint8(t); {
	case v%2 == 0:
		return fmt.Errorf("client sent an even sequence number")
	}
	return nil
}

// LastSequence is used to compare the previous sequence nubmber with the
// current sequence number and validate it
type LastSequence uint8

// Validate ensures we have a sane progression of sequence numbers in a packet exchange
func (t LastSequence) Validate(condition interface{}) error {
	last := uint8(t)
	var current uint8
	switch v := condition.(type) {
	case SequenceNumber:
		current = uint8(v)
	default:
		return fmt.Errorf("invalid type passed as a condition, it must be a SequenceNumber")
	}
	if last >= current {
		return fmt.Errorf("the last sequence number is >= to the current sequence")
	}
	return nil
}

// HeaderFlag set obfuscation and connect options.
type HeaderFlag uint8

const (
	// UnencryptedFlag indicates that the sender did not obfuscate the body of the packet.
	// Normal tacacs pacekts have this set to 0x0.
	UnencryptedFlag HeaderFlag = 0x01
	// SingleConnect is used to allow a client and server to negotiate single connection mode
	SingleConnect HeaderFlag = 0x04
)

// Set HeaderFlag's f bit.
func (b *HeaderFlag) Set(f HeaderFlag) { *b = *b | f }

// Clear HeaderFlag's f bit.
func (b *HeaderFlag) Clear(f HeaderFlag) { *b = *b &^ f }

// Toggle HeaderFlag's f bit.
func (b *HeaderFlag) Toggle(f HeaderFlag) { *b = *b ^ f }

// Has returns true when b has the f bit set.
func (b *HeaderFlag) Has(f HeaderFlag) bool { return *b&f != 0 }

// String to satisfy Fields interface
func (b HeaderFlag) String() string {
	flags := make([]string, 0, 2) // 2 supported flags
	if b.Has(UnencryptedFlag) {
		flags = append(flags, "UnencryptedFlag")
	}
	if b.Has(SingleConnect) {
		flags = append(flags, "SingleConnect")
	}
	return strings.Join(flags, "|")
}