| 796ba93b | 01-Aug-2020 |
Ed Tanous <ed@tanous.net> |
Enable HTTP additional sockets
This commit attempts to add the concept of an SSL detector from beast,
and add the capability into bmcweb. This allows directing multiple
socket files to the bmcweb i
Enable HTTP additional sockets
This commit attempts to add the concept of an SSL detector from beast,
and add the capability into bmcweb. This allows directing multiple
socket files to the bmcweb instance, and bmcweb will automatically sort
out whether or not they're SSL, and give the correct response. This
allows users to plug in erroneous urls like "https://mybmc:80" and they
will forward and work correctly.
Some key design points:
The HTTP side of bmcweb implements the exact same http headers as the
HTTPS side, with the exception of HSTS, which is explicitly disallowed.
This is for consistency and security.
The above allows bmcweb builds to "select" the appropriate security
posture (http, https, or both) for a given channel using the
FileDescriptorName field within a socket file. Items ending in:
both: Will support both HTTPS and HTTP redirect to HTTPS
https: Will support HTTPS only
http: will support HTTP only
Given the flexibility in bind statements, this allows administrators to
support essentially any security posture they like. The openbmc
defaults are:
HTTPS + Redirect on both ports 443 and port 80 if http-redirect is
enabled
And HTTPS only if http-redirect is disabled.
This commit adds the following meson options that each take an array of
strings, indexex on the port.
additional-ports
Adds additional ports that bmcweb should listen to. This is always
required when adding new ports.
additional-protocol
Specifies 'http', 'https', or 'both' for whether or not tls is enfoced
on this socket. 'both' allows bmcweb to detect whether a user has
specified tls or not on a given connection and give the correct
response.
additional-bind-to-device
Accepts values that fill the SO_BINDTODEVICE flag in systemd/linux,
and allows binding to a specific device
additional-auth
Accepts values of 'auth' or 'noauth' that determines whether this
socket should apply the normal authentication routines, or treat the
socket as unauthenticated.
Tested:
Previous commits ran the below tests.
Ran the server with options enabled. Tried:
```
curl -vvvv --insecure --user root:0penBmc http://192.168.7.2/redfish/v1/Managers/bmc
* Trying 192.168.7.2:80...
* Connected to 192.168.7.2 (192.168.7.2) port 80 (#0)
* Server auth using Basic with user 'root'
> GET /redfish/v1/Managers/bmc HTTP/1.1
> Host: 192.168.7.2
> Authorization: Basic cm9vdDowcGVuQm1j
> User-Agent: curl/7.72.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 301 Moved Permanently
< Location: https://192.168.7.2
< X-Frame-Options: DENY
< Pragma: no-cache
< Cache-Control: no-Store,no-Cache
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< Content-Security-Policy: default-src 'none'; img-src 'self' data:; font-src 'self'; style-src 'self'; script-src 'self'; connect-src 'self' wss:
< Date: Fri, 08 Jan 2021 01:43:49 GMT
< Connection: close
< Content-Length: 0
<
* Closing connection 0
```
Observe above:
webserver returned 301 redirect.
webserver returned the appropriate security headers
webserver immediately closed the connection.
The same test above over https:// returns the values as expected
Loaded the webui to test static file hosting. Webui logs in and works
as expected.
Used the scripts/websocket_test.py to verify that websockets work.
Sensors report as expected.
Change-Id: Ib5733bbe5473fed6e0e27c56cdead0bffedf2993
Signed-off-by: Ed Tanous <ed@tanous.net>
show more ...
|
| 6c58a03e | 21-Nov-2024 |
Alexander Hansen <alexander.hansen@9elements.com> |
event service: dbus log: enable event subscription
enable the event subscriptions
/redfish/v1/EventService/Subscriptions/
to work for the dbus event log.
So if you are enabling redfish-dbus-log o
event service: dbus log: enable event subscription
enable the event subscriptions
/redfish/v1/EventService/Subscriptions/
to work for the dbus event log.
So if you are enabling redfish-dbus-log option,
event subscriptions should work similar to when
this option is disabled, with one difference:
- 'MessageArgs' property is currently not implemented and cannot be
found in the returned json.
Tested:
- Using Redfish Event Listener, test subscriptions and eventing.
- Manual Test below with the Redfish Event Listener:
1. Created a maximal Event Log Subscription
redfish
{
"@odata.id": "/redfish/v1/EventService/Subscriptions/2023893979",
"@odata.type": "#EventDestination.v1_8_0.EventDestination",
"Context": "EventLogSubscription",
"DeliveryRetryPolicy": "TerminateAfterRetries",
"Destination": "http://${ip}:5000/event-receiver",
"EventFormatType": "Event",
"HttpHeaders": [],
"Id": "2023893979",
"MessageIds": [],
"MetricReportDefinitions": [],
"Name": "Event Destination 2023893979",
"Protocol": "Redfish",
"RegistryPrefixes": [],
"ResourceTypes": [],
"SubscriptionType": "RedfishEvent",
"VerifyCertificate": true
}
which matches on all registries and all message ids.
2. created a new phosphor-logging entry
busctl call xyz.openbmc_project.Logging \
/xyz/openbmc_project/logging \
xyz.openbmc_project.Logging.Create \
Create 'ssa{ss}' \
OpenBMC.0.1.PowerButtonPressed \
xyz.openbmc_project.Logging.Entry.Level.Error 0
3. bmcweb picks up this new entry via the dbus match, this can be
verified by putting bmcweb in debug logging mode.
4. the event log entry makes it through the filtering code
5. the POST request is sent to the subscribed server as expected,
and contains the same properties as with the file-based backend.
Change-Id: I122e1121389f72e67a998706aeadd052ae607d60
Signed-off-by: Alexander Hansen <alexander.hansen@9elements.com>
show more ...
|
| 2ac69850 | 22-Nov-2024 |
Ed Tanous <etanous@nvidia.com> |
Break out Dbus events into class
EventServiceManager is already too large. Implement the TODO from run
that these should be classes, and fix the issue where events are being
registered on startup,
Break out Dbus events into class
EventServiceManager is already too large. Implement the TODO from run
that these should be classes, and fix the issue where events are being
registered on startup, not on a subscription being created.
To accomplish this, this patch takes global state and breaks them out
into RAII classes from EventServiceManager, one for monitoring DBus
matches, and one for monitoring filesystem log events using inotify.
Each of these connect to static methods on EventService that can send
the relevant events to the user.
Fundamentally, no code within the two new classes is changed, and the
only changes to event service are made to support creation and
destruction of the RAII classes.
There are a number of call sites, like cacheRedfishLogFile, that are
obsoleted when the class is raii. The file will be re-cached on
creation.
Tested: WIP
No TelemetryService tests exist in Redfish.
Change-Id: Ibc91cd1496edf4a080e2d60bfc1a32e00a6c74b8
Signed-off-by: Ed Tanous <etanous@nvidia.com>
show more ...
|
| fa2d6ae7 | 26-Jul-2024 |
Ed Tanous <etanous@nvidia.com> |
Upgrade select alpn callback
nghttp2 has added a new callback[1] which solves the issue we were
seeing previously with const. This cleans up some NOLINT markers, but
should have no functional chang
Upgrade select alpn callback
nghttp2 has added a new callback[1] which solves the issue we were
seeing previously with const. This cleans up some NOLINT markers, but
should have no functional changes
[1] https://nghttp2.org/documentation/nghttp2_select_alpn.html#c.nghttp2_select_alpn
Tested:
Curl shows HTTP2 upgrade works properly.
* ALPN, offering h2
* ALPN, offering http/1.1
* ALPN, server accepted to use h2
* Using HTTP2, server supports multiplexing
* Connection state changed (HTTP/2 confirmed)
Change-Id: Ic41754c58e6166aac22ed5afca5371661db959da
Signed-off-by: Ed Tanous <etanous@nvidia.com>
show more ...
|
| 9ed3f90a | 15-Jul-2024 |
Ed Tanous <ed@tanous.net> |
Fix crash on subscriptions
When the subscription limit is hit, there is Subscription events
generated when Subscription objects are constructed. Unfortunately, we
make an accidental copy of the Sub
Fix crash on subscriptions
When the subscription limit is hit, there is Subscription events
generated when Subscription objects are constructed. Unfortunately, we
make an accidental copy of the Subscription object in
include/persistent_data.hpp
https://gerrit.openbmc.org/c/openbmc/bmcweb/+/72670
Is lined up to fix that issue, but we need to fix the underlying problem
where we have memory safety issues in global variables.
This commit is something to fix the issue, by simply destroying the
object causing the problem before more events can be received.
Tested:
Followed instructions on the aforementioned commit to create the max
number of subscriptions.
Called systemctl restart bmcweb
Observed no more crash on shutdown.
Change-Id: Ie52545f5cb8a044c186d0e9db47362e170b1fdb5
Signed-off-by: Ed Tanous <ed@tanous.net>
show more ...
|
| b7f3a82b | 05-Jun-2024 |
Ed Tanous <ed@tanous.net> |
Break out random ID methods
The method of creating a random ID from an openssl random generator of a
particular length is something that is generally useful, and something
we can write unit tests fo
Break out random ID methods
The method of creating a random ID from an openssl random generator of a
particular length is something that is generally useful, and something
we can write unit tests for. Add it.
Tested:
Redfish service validator login flows work correctly in redfish service
validator.
Change-Id: Ic3b58d33f1421f3eb39e2d57585958f87f6fb8ea
Signed-off-by: Ed Tanous <ed@tanous.net>
show more ...
|
| 25b54dba | 17-Apr-2024 |
Ed Tanous <ed@tanous.net> |
Bring consistency to config options
The configuration options that exist in bmcweb are an amalgimation of
CROW options, CMAKE options using #define, pre-bmcweb ifdef mechanisms
and meson options usi
Bring consistency to config options
The configuration options that exist in bmcweb are an amalgimation of
CROW options, CMAKE options using #define, pre-bmcweb ifdef mechanisms
and meson options using a config file. This history has led to a lot of
different ways to configure code in the codebase itself, which has led
to problems, and issues in consistency.
ifdef options do no compile time checking of code not within the branch.
This is good when you have optional dependencies, but not great when
you're trying to ensure both options compile.
This commit moves all internal configuration options to:
1. A namespace called bmcweb
2. A naming scheme matching the meson option. hyphens are replaced with
underscores, and the option is uppercased. This consistent transform
allows matching up option keys with their code counterparts, without
naming changes.
3. All options are bool true = enabled, and any options with _ENABLED or
_DISABLED postfixes have those postfixes removed. (note, there are
still some options with disable in the name, those are left as-is)
4. All options are now constexpr booleans, without an explicit compare.
To accomplish this, unfortunately an option list in config/meson.build
is required, given that meson doesn't provide a way to dump all options,
as is a manual entry in bmcweb_config.h.in, in addition to the
meson_options. This obsoletes the map in the main meson.build, which
helps some of the complexity.
Now that we've done this, we have some rules that will be documented.
1. Runtime behavior changes should be added as a constexpr bool to
bmcweb_config.h
2. Options that require optionally pulling in a dependency shall use an
ifdef, defined in the primary meson.build. (note, there are no
options that currently meet this class, but it's included for
completeness.)
Note, that this consolidation means that at configure time, all options
are printed. This is a good thing and allows direct comparison of
configs in log files.
Tested: Code compiles
Server boots, and shows options configured in the default build. (HTTPS,
log level, etc)
Change-Id: I94e79a56bcdc01755036e4e7278c7e69e25809ce
Signed-off-by: Ed Tanous <ed@tanous.net>
show more ...
|
| 36c0f2a3 | 09-Feb-2024 |
Ed Tanous <ed@tanous.net> |
Consolidate Vm implementations
As much as the two vm implementations SEEM different, the differences
largely lie in how we're getting the nbd proxy socket. One is relying
on launching a process (nb
Consolidate Vm implementations
As much as the two vm implementations SEEM different, the differences
largely lie in how we're getting the nbd proxy socket. One is relying
on launching a process (nbd-proxy), the other is getting the fd from
dbus. Given [1] exists and is in process, we need to have a plan for
getting these two VM implementations into one, once that patchset is
complete.
This commit: Splits the vm-websocket option into vm-websocket-provider,
providing two options, nbd-proxy, and virtual-media (the names of the
respective apps). To accomplish this, it moves the contents of
nbd-proxy into include/vm-websocket, so we can compare the similarities
and start consolidating.
The longer term intent is that the nbd-proxy option will be completely
removed, and the code deleted. This has the additional advantage that
we will no longer require the boost::process dependency, as all info
will be available on dbus.
As part of this, the nbd proxy websocket is also registered at /vm/0/0,
to be backward compatible with the old interfaces.
Tested: Code compiles. Need some help here.
[1] https://gerrit.openbmc.org/c/openbmc/jsnbd/+/49944
Change-Id: Iedbca169ea40d45a8775f843792b874a248bb594
Signed-off-by: Ed Tanous <ed@tanous.net>
show more ...
|