This interface exists to provide a means of connecting to an IPMIv2 enabled
BMC.  In some places, the IPMIv2 specification is either unclear or
inconsistent, and interpretations of the intent of the specification had to
be made at the discretion of the implementor.  The purpose of this
document is to make those decisions clear so that 1) they can be reviewed
by others and 2) so that the rationale for those decisions can be made
clear.

* Though it's not stated explicitly with which algorithm the K1 and K2 keys
should be generated, we chose to use the authentication algorithm.  The
specification states that K1 and K2 are generated with an HMAC algorithm,
and all of the authentication algorithms (except for "none") are HMAC
algorithms, whereas the integrity algorithms are not all HMAC.  See section
13.32 for details about K1 and K2, and section


* The IPMIv2 specification describes a key, Kg, that is the "BMC key".
This key functions as a global key that is required to be known in addition
to the user's key, by authenticating users.  If the BMC has a null Kg, the
users key, Kuid, is used in its place in algorithms where Kg is required,
per the specification section 13.33.  A user can obtain the status of Kg by
querying the BMC with the Get Channel Authentication Capabilities command.
Currently, this implementation does not provide a way for a user to specify
Kg for BMCs that require it.


* The specification is unclear as to which key is used for HMAC based
integrity checking.  One the one hand, section 13.28.4 states explicitly
that HMAC integrity algorithms use the session integrity key as the HMAC
key.  Confusing that matter is a statement in section 13.32 regarding the
creation of additional keying material.  In this section it is stated that
"all keying material for the RSP integrity and confidentiality algorithms
will be generated by processing a pre-defined set of constants using HMAC
per [RFC2104], keyed by sik".  And "For the mandatory-to-implement
integrity and confidentiality algorithms defined in this specification,
processing the first two (2) constants will generate the require amount of
keying material."  We decided to use K1 as our HMAC key for the generation
of authentication codes (integrity checking).  Furthermore, we are using
all 20 bytes of K1.


* IPMIv2 compliant BMCs are supposed to support 20 byte passwords, as well
store metadata describing whether the password was stored as a 16 byte or
20 byte class password.  We do not currently support 20 byte passwords.  It
should be noted that there are obvious mistakes in the SET USER PASSWORD
command specification, as it mentions the ability to query for 16/20 byte
password status, but the packet format does not support this.


* The IPMIv2 specification describes a type of login called a "role only
login."  This feature allows a user to login providing only a requested
privilege level and a password.  We do not currently support this feature.
Supporting this feature would only require the ability to specify
username/privilege lookups in the RAKP 1 message sent from ipmitool.  We
currently specify the use of username only lookups for authentication.


* In the IPMIv2 packet description in table 13-8 of the IPMv2
specification, there are two fields that are rather ambiguous in meaning.
The fields are "Pad Length" and "Next Header".  Although neither field is
listed as belonging to the IPMIv2 packet format, we include/expect them
both in our IPMIv2 packets.  Are rationale is 1) the Next Headers field's
comment states what the value of that field should be for IPMIv2, and 2)
for the most part the ASF and IPMIv2 fields seem to parallel each other,
and we feel that the Pad Length and Next Header fields were left out of the
IPMIv2 column by mistake.


* The GET CHANNEL CIPHER SUITES command documentation seems to have
mistakes.  The "start of record" byte is stated to be either 0x30 or 0x31,
whereas the detailed description in table 22-18 leads us to believe that
this byte should really be 0xC0 or 0xC1.  Also the description of bits 5:0
in the start of record byte should probably be 00_0000 rather than 00_000.

This document was last updated for release 1.8.8.

This document explains how Serial Over Lan is implemented on in the
ipmitool IPMI client.  Obviously, the code itself is authoritative, but
this document should serve as a good starting point.

Serial Over Lan (SOL) is defined in the IPMI v2 specification published by
Intel and available at http://www.intel.com/design/servers/ipmi/.  SOL
functionality is built on top of the RMCP+ protocol as an additional
payload type (type 1).

The high end SOL logic is implemented in src/ipmitool/lib/ipmi_sol.c.  SOL
sessions are begun in ipmitool using the "sol activate" command.  This
command maps directly to the IPMI Activate Payload command.  It first
verifies that an RMCP+ session (lanplus interface) is being used to
establish the session.  Although the spec allows for a SOL connection to be
established on a port different than the RMCP+ port that the "activate
payload" command issued, ipmitool does not support this.

Once a session has been established (the activate payload command
succeeds), ipmitool simply loops over a select() on user input and data
returned from the BMC.  All user input is first filtered so that special
escape sequences can suspend or deactivate the SOL session and so that data
can be broken into chunks no greater than N bytes.  This maximum is
specified by the BMC in the response to the Activate Payload command.

User input to the BMC is handled in ipmitool/src/plugins/lanplus/lanplus.c.
Every SOL packet (with one exception) traveling in either direction causes
the recipient to return an acknowledgement packet, though acks themself are
not acknowledged.  The transport layer in lanplus.c handles the logic
regarding acks, partial acks, sequence numbers.  SOL acknowledgements
packets be acks, partial acks (the remote destination processed only some
of the data), and nacks (requests to stop sending packets).  Nacks are not
honored by ipmitool.

Note that one way that SOL communication differs from standard IPMI
commands, is that it is not simply a request response protocol.  Packets
may be returned asyncrhonously from the BMC.  When establishing a SOL
session, ipmitool registers a callback for asynchonously received data.
This call back simply prints text returned from the BMC.

Once a user has chosen to exit the SOL session (with ~.) ipmitool sends the
IPMI SOL Deactivate command to the BMC.

The standard code path for SOL logic follows:
    ipmi_sol_main (ipmi_sol.c):

    ipmi_sol_activate (ipmi_sol.c):
        Argument validation
        Creation and dispatch of IPMI Activate Payload command

    ipmi_sol_red_pill (ipmi_sol.c):
        Loop on select() for user input and data returned from the BMC
        Periodic dispatch of "keep alive" packet to the BMC.
        Send user input to the BMC and BMC data to the console.

        processSolUserInput (ipmi_sol.c):
            Process possible escape sequences (~., ~B, etc.)
            Send (with retries) user data to the BMC
            Partial creation of packet payload

                ipmi_lanplus_send_sol (lanplus.c):
                    Completion of packet payload
                    Send (with retries) of SOL packet

                     ipmi_lanplus_send_payload (lanplus.c):
                         Creation of RMCP+ packet
                         Details general to all V2 packet processing, as
                         well as a some logic to handle ack reception.

                     is_sol_partial_ack (lanplus.c):
                         Determine whether a data needs to be resent

        ipmi_lanplus_recv_sol (lanplus.c):
            Handle data received by the BMC.  Ack as appropriate.