Be more paranoid in json parsing

When taking json directly from a user, we should set some limits on
parsing depth as well as total number of value elements. Value elements
are considered any indiv

Be more paranoid in json parsing

When taking json directly from a user, we should set some limits on
parsing depth as well as total number of value elements. Value elements
are considered any individual value, the start of an array, the start of
a dictionary, or null. This is to prevent flooding type attacks
creating large number of objects, while still keeping under the depth 10
cap. This commit makes use of the nlohmann sax parse to handle this by
injecting a new error handler in between that will impose new limits.

Currently this sets the depth limit to 10 and the total number of keys
to 500; These are intentionally high, and could be tuned or expanded on
in the future.

Tested: Unit tests pass.

Change-Id: I789543679e22b0b0ce0b2b0b71f31377b0759cd7
Signed-off-by: Ed Tanous <etanous@nvidia.com>

show more ...

Fix webassets to support Vite build output

The webui-vue project migrated from webpack to Vite, which changes
the output filenames. Vite names entry chunks as index.[hash].js
instead of webpack's a

Fix webassets to support Vite build output

The webui-vue project migrated from webpack to Vite, which changes
the output filenames. Vite names entry chunks as index.[hash].js
instead of webpack's app.[hash].js. The starts_with("index.") check
in addFile() was remapping these JS/CSS files to their parent directory
path (intended only for index.html), causing 404 errors when the
browser requested the actual asset URLs.

Restrict the index file detection to only apply to .html files, so
that index.html is still correctly mapped to "/" while other files
starting with "index." are served at their actual paths.

Also broaden the etag hash detection from hex-only characters to full
alphanumeric to support Vite's base64-style content hashes alongside
webpack's hex hashes.

Add unit tests for getStaticEtag() covering both webpack and Vite hash
formats, path prefixes, edge cases, and validation of hash length and
character constraints.

Tested:
Unit tests pass
Vite-based webui-vue loads and caches etags

Change-Id: I3f7d2e062d0fd8be4ded7889b64a7228b4a6459b
Signed-off-by: Jason Westover <jwestover@nvidia.com>
Signed-off-by: Ed Tanous <etanous@nvidia.com>

show more ...

zstd compression

zstd compression allows for reducing the size of payloads with repeating
elements. Pretty printed json is one very specific case where we would
prefer to not change the behavior, b

zstd compression

zstd compression allows for reducing the size of payloads with repeating
elements. Pretty printed json is one very specific case where we would
prefer to not change the behavior, but would also like to avoid the
overhead of TLS compression.

When ztd is present, the webserver will look for the Accepts-Encoding
header to contain zstd, and if it does, compress the payload before
sending.

Tested:
Webui loads correctly, and shows zstd being used for download.
Redfish service validator runs. (does not support zstd)
Unit tests pass.

Change-Id: Ic575911fea70d218d1efb4df030d3cc098f1ecd0
Signed-off-by: Ed Tanous <etanous@nvidia.com>

show more ...

Sensors: Convert fan_tach sensors to Percent

Redfish 2025.3 clarified the reporting of fan sensors should always be
as ReadingType Percent to address issue #6197. [1] The fan_tach
sensors on D-Bus a

Sensors: Convert fan_tach sensors to Percent

Redfish 2025.3 clarified the reporting of fan sensors should always be
as ReadingType Percent to address issue #6197. [1] The fan_tach
sensors on D-Bus are Rotational sensors. Conversion is necessary for
these sensor values to reflect Percent instead. [2] This is reflected in
a published mockup. [3]

The Redfish update includes an additional sentence for the ReadingType
description:

```
"... Services should represent fan speed and pump speed sensors with the `ReadingType` value `Percent`."
```

The ReadingRangeMax and ReadingRangeMin properties also must be
converted to percent basis as they are defined to reflect the range of
the Reading property.

```
curl -s https://redfish.dmtf.org/schemas/v1/Sensor.v1_11_1.json | jq .definitions.Sensor.properties.ReadingRangeMax.longDescription
"This property shall indicate the maximum possible value of the `Reading` property for this sensor. This value is the range of valid readings for this sensor. Values outside this range are discarded as reading errors."
```

A new compile option, redfish-allow-rotational-fans, will maintain the
old behavior of reporting fan_tach sensors as Rotational. When the
option is disabled they will be reported as Percent. This will allow
time for distributions to make adjustments to handle Percent reported
fan sensors.

The SpeedRPM Redfish property contains the RPM value for these sensors
whether this option is enabled or disabled. Clients wanting to use the
RPM value should convert to use the SpeedRPM property instead of the
Reading property.

```
curl -s https://redfish.dmtf.org/schemas/v1/Sensor.v1_11_1.json | jq .definitions.Sensor.properties.SpeedRPM
{
"description": "The rotational speed.",
"excerpt": "SensorFan,SensorFanArray,SensorPump",
"longDescription": "This property shall contain a reading of the rotational speed of the device in revolutions per minute (RPM) units.",
"readonly": true,
"type": [
"number",
"null"
],
"units": "{rev}/min",
"versionAdded": "v1_2_0"
}
```

With the compile option disabled the following differences will be
reflected in the responses for /redfish/v1/Chassis/chassis/Sensors/{}:
- ReadingRangeMax/ReadingRangeMin: Converted to percent range, (100,0)
- ReadingType: "Percent"
- ReadingUnits: "%"
- Reading: Computed percent value. The computation is the percent of
the RPM Value within the MaxValue to MinValue range as reported by
D-Bus for the sensor.
- Note: If the percent cannot be computed for any reason the Reading
property is set to null.
- Note: SpeedRPM: Remains unchanged, it continues to report the RPM
value as reported by D-Bus.

Implementation Notes:
- The SensorFanExcerpt and SensorFanArrayExcerpt definitions also
include the SpeedRPM property. So moved setting of this property to
be handled for excerpts as well.
- The Sensor schema version has been updated regardless of the compile
option setting.

[1] https://github.com/DMTF/Redfish/issues/6197
[2] https://redfish.dmtf.org/schemas/v1/Sensor.v1_11_1.json
[3] https://github.com/DMTF/Redfish-Publications/blob/main/mockups/public-rackmount1/Chassis/1U/Sensors/CPUFan1/index.json

Tested:
- Added new unit tests for new function getFanPercent()
- Adjusted existing unit tests for Sensors to reflect changes for
fan_tach sensors.
- Redfish Service Validator passes (with option enabled and disabled)
- Using hardware simulator hand-edited values for the min/max of the
fan_tach sensors:
- Option enabled: confirmed Redfish response same before and after
code changes.
- Option disabled: Confirmed Redfish responses and percent
calculation.

Example responses with compile option disabled:
```
// D-Bus: "Value" d 18000 "MaxValue" d 18000 "MinValue" d 0
curl -s -k -H "X-Auth-Token: $token" -X GET https://${bmc}/redfish/v1/Chassis/chassis/Sensors/fantach_fan0_0
{
"@odata.id": "/redfish/v1/Chassis/chassis/Sensors/fantach_fan0_0",
"@odata.type": "#Sensor.v1_11_1.Sensor",
"Id": "fantach_fan0_0",
"Name": "fan0 0",
"Reading": 100,
"ReadingRangeMax": 100,
"ReadingRangeMin": 0,
"ReadingType": "Percent",
"ReadingUnits": "%",
"SpeedRPM": 18000.0,
"Status": {
"Health": "OK",
"State": "Enabled"
}
}

// D-Bus: "Value" d 18000 "MaxValue" d 36000 "MinValue" d 0
curl -s -k -H "X-Auth-Token: $token" -X GET https://${bmc}/redfish/v1/Chassis/chassis/Sensors/fantach_fan1_0
{
"@odata.id": "/redfish/v1/Chassis/chassis/Sensors/fantach_fan1_0",
"@odata.type": "#Sensor.v1_11_1.Sensor",
"Id": "fantach_fan1_0",
"Name": "fan1 0",
"Reading": 50,
"ReadingRangeMax": 100,
"ReadingRangeMin": 0,
"ReadingType": "Percent",
"ReadingUnits": "%",
"SpeedRPM": 18000.0,
"Status": {
"Health": "OK",
"State": "Enabled"
}
}

// Minimum is non-zero
// D-Bus: "Value" d 18000 "MaxValue" d 27000 "MinValue" d 9000
curl -s -k -H "X-Auth-Token: $token" -X GET https://${bmc}/redfish/v1/Chassis/chassis/Sensors/fantach_fan2_0
{
"@odata.id": "/redfish/v1/Chassis/chassis/Sensors/fantach_fan2_0",
"@odata.type": "#Sensor.v1_11_1.Sensor",
"Id": "fantach_fan2_0",
"Name": "fan2 0",
"Reading": 50,
"ReadingRangeMax": 100,
"ReadingRangeMin": 0,
"ReadingType": "Percent",
"ReadingUnits": "%",
"SpeedRPM": 18000.0,
"Status": {
"Health": "OK",
"State": "Enabled"
}
}

// Minimum is not initialized - Reading is null
// D-Bus: "Value" d 18000 "MaxValue" d 18000 "MinValue" d -inf
curl -s -k -H "X-Auth-Token: $token" -X GET https://${bmc}/redfish/v1/Chassis/chassis/Sensors/fantach_fan3_0
{
"@odata.id": "/redfish/v1/Chassis/chassis/Sensors/fantach_fan3_0",
"@odata.type": "#Sensor.v1_11_1.Sensor",
"Id": "fantach_fan3_0",
"Name": "fan3 0",
"Reading": null,
"ReadingRangeMax": 100,
"ReadingRangeMin": 0,
"ReadingType": "Percent",
"ReadingUnits": "%",
"SpeedRPM": 18000.0,
"Status": {
"Health": "OK",
"State": "Enabled"
}
}

// Minimum and Maximum are not initialized - so Reading is null
// D-Bus: "Value" d 18000 "MaxValue" d inf "MinValue" d -inf
curl -s -k -H "X-Auth-Token: $token" -X GET https://${bmc}/redfish/v1/Chassis/chassis/Sensors/fantach_fan4_0
{
"@odata.id": "/redfish/v1/Chassis/chassis/Sensors/fantach_fan4_0",
"@odata.type": "#Sensor.v1_11_1.Sensor",
"Id": "fantach_fan4_0",
"Name": "fan4 0",
"Reading": null,
"ReadingRangeMax": 100,
"ReadingRangeMin": 0,
"ReadingType": "Percent",
"ReadingUnits": "%",
"SpeedRPM": 18000.0,
"Status": {
"Health": "OK",
"State": "Enabled"
}
}
```

Example of unchanged response with compile option enabled:
```
curl -s -k -H "X-Auth-Token: $token" -X GET https://${bmc}/redfish/v1/Chassis/chassis/Sensors/fantach_fan0_0
{
"@odata.id": "/redfish/v1/Chassis/chassis/Sensors/fantach_fan0_0",
"@odata.type": "#Sensor.v1_11_1.Sensor",
"Id": "fantach_fan0_0",
"Name": "fan0 0",
"Reading": 18000.0,
"ReadingRangeMax": 18000.0,
"ReadingRangeMin": 0.0,
"ReadingType": "Rotational",
"ReadingUnits": "RPM",
"SpeedRPM": 18000.0,
"Status": {
"Health": "OK",
"State": "Enabled"
}
}
```

Change-Id: I8ec1e739bcd5ebce7453a2570569f2edc2284341
Signed-off-by: Janet Adkins <janeta@us.ibm.com>

show more ...

Fabric: add support for PCIe Switch Port URI

This patch enable support for following properties for Port of a PCIe
Switch. [1]
- PortProtocol
- PortType
- CurrentSpeedGbps
- ActiveWidth

One of the

Fabric: add support for PCIe Switch Port URI

This patch enable support for following properties for Port of a PCIe
Switch. [1]
- PortProtocol
- PortType
- CurrentSpeedGbps
- ActiveWidth

One of the devices that gets enabled with this patch is Nvidia ConnectX
devices, which are network cards featuring an integrated PCIe switch.
These devices combine both PCIe ports and network ports in a single
unit. Since such devices don't strictly qualify as Fabric Adapters, the
Switch URI is used instead of the FabricAdapter URI.

Port schema only allows certain URIs as Port URI. URI
/redfish/v1/Fabrics/{FabricId}/Switches/{SwitchId}/Ports/{PortId} seems
most appropriate choice for PCIe Switch Port. [1]

The Fabric resource is modeled similarly to the System resource, meaning
that only one Fabric resource will exist for each BMC. Route handler for
collections and each individual components are added in this patch for
each URI resource under /redfish/v1/Fabrics.

DBus Interface "xyz.openbmc_project.Inventory.Item.PCIeSwitch" is used
to identify the Switch resources. Association between Switch and Port is
`connecting` and `connected_to`.

Feature like Port Metrics properties (for PCIe Error Counters) can be
added in future at Port Metric URI.

dbus-sensors patches -
https://gerrit.openbmc.org/c/openbmc/dbus-sensors/+/84079
https://gerrit.openbmc.org/c/openbmc/dbus-sensors/+/83202

Tested: Build an image for nvl32-obmc machine with the following patch
cherry picked.

https://gerrit.openbmc.org/c/openbmc/dbus-sensors/+/84079
https://gerrit.openbmc.org/c/openbmc/openbmc/+/85490

The openbmc patch cherry-picks the following patches that are currently
under review.

```
1. device tree
https://lore.kernel.org/all/aRbLqH8pLWCQryhu@molberding.nvidia.com/
2. mctpd patches
https://github.com/CodeConstruct/mctp/pull/85
3. u-boot changes
https://lore.kernel.org/openbmc/20251121-msx4-v1-0-fc0118b666c1@nvidia.com/T/#t
4. kernel changes as specified in the openbmc patch (for espi)
5. entity-manager changes
https://gerrit.openbmc.org/c/openbmc/entity-manager/+/85455
6. platform-init changes
https://gerrit.openbmc.org/c/openbmc/platform-init/+/85456
7. spi changes
https://lore.kernel.org/all/20251121-w25q01jv_fixup-v1-1-3d175050db73@nvidia.com/
```

redfish service validator is passing.

```
$ curl -k -u 'root:0penBmc' https://${bmc_ip}/redfish/v1/Fabrics/
{
"@odata.id": "/redfish/v1/Fabrics",
"@odata.type": "#FabricCollection.FabricCollection",
"Members": [
{
"@odata.id": "/redfish/v1/Fabrics/fabric"
}
],
"Members@odata.count": 1,
"Name": "Fabric Collection"
}%

$ curl -k -u 'root:0penBmc' https://${bmc_ip}/redfish/v1/Fabrics/fabric/
{
"@odata.id": "/redfish/v1/Fabrics/fabric",
"@odata.type": "#Fabric.v1_2_0.Fabric",
"Id": "fabric",
"Name": "fabric Fabric",
"Switches": {
"@odata.id": "/redfish/v1/Fabrics/fabric/Switches"
}
}%

$ curl -k -u 'root:0penBmc' https://${bmc_ip}/redfish/v1/Fabrics/fabric/Switches/
{
"@odata.id": "/redfish/v1/Fabrics/fabric/Switches",
"@odata.type": "#SwitchCollection.SwitchCollection",
"Members": [
{
"@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0"
},
{
"@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_1"
},
{
"@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_2"
},
{
"@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_3"
}
],
"Members@odata.count": 4,
"Name": "fabric Switch Collection"
}%

$ curl -k -u 'root:0penBmc' https://${bmc_ip}/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0
{
"@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0",
"@odata.type": "#Switch.v1_7_0.Switch",
"Id": "Nvidia_ConnectX_0",
"Name": "Nvidia_ConnectX_0",
"Ports": {
"@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports"
},
"Status": {
"Health": "OK",
"State": "Enabled"
}
}%

$ curl -k -u 'root:0penBmc' https://${bmc_ip}/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports/
{
"@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports",
"@odata.type": "#PortCollection.PortCollection",
"Members": [
{
"@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports/DOWN_0"
},
{
"@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports/DOWN_1"
},
{
"@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports/UP_0"
}
],
"Members@odata.count": 3,
"Name": "Nvidia_ConnectX_0 Port Collection"
}%

$ curl -k -u 'root:0penBmc' https://${bmc_ip}/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports/UP_0/
{
"@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports/UP_0",
"@odata.type": "#Port.v1_4_0.Port",
"ActiveWidth": 8,
"CurrentSpeedGbps": 32.0,
"Id": "UP_0",
"Metrics": {
"@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports/UP_0/Metrics"
},
"Name": "Nvidia_ConnectX_0 UP_0 Port",
"PortProtocol": "PCIe",
"PortType": "UpstreamPort",
"Status": {
"Health": "OK",
"State": "Enabled"
}
}%
```

[1]: https://redfish.dmtf.org/schemas/v1/Port_v1.xml

Change-Id: I52f4ca62b4953f6196c589e340602a0d7885d9c1
Signed-off-by: Harshit Aghera <haghera@nvidia.com>

show more ...

Do not allow data beyond the trailer

There is nothing in the multipart spec[1] that states that a parser
should allow any bytes after a multipart payload.

Several unit tests have a \r\n after their

Do not allow data beyond the trailer

There is nothing in the multipart spec[1] that states that a parser
should allow any bytes after a multipart payload.

Several unit tests have a \r\n after their boundary condition that
previously the parser just ignored. Testing shows this is fairly
normal, so handle both cases still, but if any other characters show up,
fail the parse.

Unit test is also simplified to be more clear.

Tested: Unit test coverage

[1] https://datatracker.ietf.org/doc/html/rfc7578#section-4.1

Change-Id: I16643c61867708886cc87c236447ec1c19bf934f
Signed-off-by: Ed Tanous <etanous@nvidia.com>

show more ...

Don't use at for field access in tests

at() throws an exception when a field doesn't exist. This is somewhat
paradoxical when using EXPECT_EQ, as that is not supposed to stop the
test on a failure.

Don't use at for field access in tests

at() throws an exception when a field doesn't exist. This is somewhat
paradoxical when using EXPECT_EQ, as that is not supposed to stop the
test on a failure. Convert calls to use operator[] which does not
throw.

Tested: Unit test

Change-Id: I9f1af1732294f2755f0beb422cffe0eb379f4e76
Signed-off-by: Ed Tanous <etanous@nvidia.com>

show more ...

test: Add Cables and JsonSchemas to service root test

Add test assertions for Cables and JsonSchemas endpoints in the
ServiceRoot response. These verify that both endpoints are properly
exposed with

test: Add Cables and JsonSchemas to service root test

Add test assertions for Cables and JsonSchemas endpoints in the
ServiceRoot response. These verify that both endpoints are properly
exposed with their respective @odata.id URIs at /redfish/v1/Cables
and /redfish/v1/JsonSchemas

Change-Id: Icec5d2c5a99872f6a44a6c82f0d5ab02490d9339
Signed-off-by: Ramya Sivakumar <sramya@ami.com>

show more ...

Remove usages of nlohmann::json::begin()

nlohmann::json::begin() throws an uncaught exception.

Tested: Redfish service validator passes.

Signed-off-by: Ed Tanous <ed@tanous.net>
Change-Id: I08244b

Remove usages of nlohmann::json::begin()

nlohmann::json::begin() throws an uncaught exception.

Tested: Redfish service validator passes.

Signed-off-by: Ed Tanous <ed@tanous.net>
Change-Id: I08244b0787cd4d6e592b0731196490a5160aba62

show more ...

Sensors: Add unit tests

An earlier commit [1] refactored parts of objectPropertiesToJson() into
sub-functions to make the code easier to follow. The review of that
change requested unit tests for th

Sensors: Add unit tests

An earlier commit [1] refactored parts of objectPropertiesToJson() into
sub-functions to make the code easier to follow. The review of that
change requested unit tests for these new functions. [2] This commit
adds them.

[1] https://gerrit.openbmc.org/c/openbmc/bmcweb/+/85835
[2] https://gerrit.openbmc.org/c/openbmc/bmcweb/+/85835/comments/408617a1_474b4062

Tested: Compiles and unit tests pass

Change-Id: I65e06deccb4b7194603f2749a977986bcb673cd1
Signed-off-by: Janet Adkins <janeta@us.ibm.com>

show more ...

sensor_utils: Add PeakReading property

Add support for PeakReading and PeakReadingTime for sensors. This
enhancement allows sensor readings to include max observed value
information in the Redfish A

sensor_utils: Add PeakReading property

Add support for PeakReading and PeakReadingTime for sensors. This
enhancement allows sensor readings to include max observed value
information in the Redfish API, along with timestamp. It uses PDI
xyz.openbmc_project.Telemetry.Report. Property PeakReading is added if
OperationType in PDI property ReadingParameters is set to Maximum.

Current Limitation -
The ResetMetrics action is currently not supported for sensor URIs. As a
result, the ability to clear PeakReading values for GPU Power Sensors
has not been implemented.

Future Consideration -
If ResetMetrics action support is added in the future, the corresponding
functionality will also need to be implemented in the dbus-sensor
application to ensure full compatibility.

Schema:
https://redfish.dmtf.org/schemas/v1/Sensor.v1_2_0.yaml (PeakReading)

Backend implementation for reference:
https://gerrit.openbmc.org/c/openbmc/dbus-sensors/+/82479

Tested: Build an image for nvl32-obmc machine with the following patches
cherry picked.

https://gerrit.openbmc.org/c/openbmc/openbmc/+/85490
https://gerrit.openbmc.org/c/openbmc/bmcweb/+/82449.

The patch cherry-picks the following patches that are currently under
review.

```
1. device tree
https://lore.kernel.org/all/aRbLqH8pLWCQryhu@molberding.nvidia.com/
2. mctpd patches
https://github.com/CodeConstruct/mctp/pull/85
3. u-boot changes
https://lore.kernel.org/openbmc/20251121-msx4-v1-0-fc0118b666c1@nvidia.com/T/#t
4. kernel changes as specified in the openbmc patch (for espi)
5. entity-manager changes
https://gerrit.openbmc.org/c/openbmc/entity-manager/+/85455
6. platform-init changes
https://gerrit.openbmc.org/c/openbmc/platform-init/+/85456
7. spi changes
https://lore.kernel.org/all/20251121-w25q01jv_fixup-v1-1-3d175050db73@nvidia.com/
```

```
> curl -s -k -u 'root:0penBmc' https://10.137.203.137/redfish/v1/Chassis/NVIDIA_GB200_1/Sensors/power_NVIDIA_GB200_GPU_0_Power_0
{
"@odata.id": "/redfish/v1/Chassis/NVIDIA_GB200_1/Sensors/power_NVIDIA_GB200_GPU_0_Power_0",
"@odata.type": "#Sensor.v1_2_0.Sensor",
"Id": "power_NVIDIA_GB200_GPU_0_Power_0",
"Name": "NVIDIA GB200 GPU 0 Power 0",
"PeakReading": 52.671,
"PeakReadingTime": 0,
"Reading": 27.214,
"ReadingRangeMax": 5000.0,
"ReadingRangeMin": 0.0,
"ReadingType": "Power",
"ReadingUnits": "W",
"Status": {
"Health": "OK",
"State": "Enabled"
}
}%
````

Change-Id: I8c1ab6ce85f31419db4a1d931bf99722d24afbd7
Signed-off-by: Harshit Aghera <haghera@nvidia.com>

show more ...

Add remaining functions to systems_utils namespace

Initially, systems_utils.hpp has not defined its own namespace, all
functions were under the redfish namespace. Patch 82078 [1] introduced
systems_

Add remaining functions to systems_utils namespace

Initially, systems_utils.hpp has not defined its own namespace, all
functions were under the redfish namespace. Patch 82078 [1] introduced
systems_utils namespace to the header for new functionality.

This patch adds all functions, that haven't been part of the new
namespace to systems_utils namespace and updates all call sites
accordingly.

[1] https://gerrit.openbmc.org/c/openbmc/bmcweb/+/82078

Tested: Code compiles.

Change-Id: Ia6ac3edd36aacc22cbf1a6adae4e2b264932b43c
Signed-off-by: Oliver Brewka <oliver.brewka@9elements.com>

show more ...

Add temp file and FD support to TemporaryFileHandle

This commit adds file descriptor and temporary file management to
DuplicatableFileHandle, removing the redundant test-only
TemporaryFileHandle uti

Add temp file and FD support to TemporaryFileHandle

This commit adds file descriptor and temporary file management to
DuplicatableFileHandle, removing the redundant test-only
TemporaryFileHandle utility.

Changes:
- Add file descriptor constructor and setFd() method
- Add temporary file constructor with string_view content
- Add filePath member and automatic cleanup in destructor
- Add configurable temp-dir meson option (default: /tmp/bmcweb)
- Remove include/file_test_utilities.hpp
- Update all tests to use DuplicatableFileHandle
- Rename stringPath to filePath

These features will be used by the multipart parser to stream
large uploads to temporary files instead of keeping them in memory,
and by the update service to pass file descriptors over D-Bus.

Change-Id: I982f5928d453f9f0c13d91c3525006134ddc87b3
Signed-off-by: Rajeev Ranjan <ranjan.rajeev1609@gmail.com>

show more ...

Correct the version of Message Id

Applications are logging Redfish Message ID to journal, but the version
of some message ID are different with the definition of bmcweb. E.g:
- psusensor is defining

Correct the version of Message Id

Applications are logging Redfish Message ID to journal, but the version
of some message ID are different with the definition of bmcweb. E.g:
- psusensor is defining version of OpenBMC registry is "0.1" as [1].
- The bmcweb defines the version of OpenBMC registry is "0.5" as [2].

It makes the "MessageId" property of Event log's enties has different
version with definition in the /redfish/v1/Registries.

This commit corrects the version of Message ID.

[1]: https://github.com/openbmc/dbus-sensors/blob/6b7123225fc4a5180faf89190e9f64a7e248e697/src/psu/PSUEvent.cpp#L121
[2]: https://github.com/openbmc/bmcweb/blob/master/redfish-core/include/registries/openbmc.json#L1678

Tested:
Verify the version of Events are the same the version of Registries
that are defined in the bmcweb.

Change-Id: Ib862c8d0a62cae63082436cb4646a9ca45207872
Signed-off-by: Thang Tran <thuutran@amperecomputing.com>

show more ...

Use std::format for hex conversions

Deprecate intoToHex handler now that we can do everything using
std::format.

Tested: RSV passes
Redfish protocol validator passes

Change-Id: I71000506573314d6c9

Use std::format for hex conversions

Deprecate intoToHex handler now that we can do everything using
std::format.

Tested: RSV passes
Redfish protocol validator passes

Change-Id: I71000506573314d6c9326c4677f5fbca1ca02b46
Signed-off-by: Ed Tanous <etanous@nvidia.com>

show more ...

fix: add account checking inside verifyMtls

Currently if we don't have account in bmcweb but have valid format
certificate, we will have 500 internal server error when we send request
to bmcweb. But

fix: add account checking inside verifyMtls

Currently if we don't have account in bmcweb but have valid format
certificate, we will have 500 internal server error when we send request
to bmcweb. But, if we don't have valid format certificate, we will get
401 unauthorized. This is not ideal as the http code is not appropriate.
Also, this might introduce some security risk as the user can deduce
whether their certificate format is valid or not based on the http code.

This patch is intended to solve this issue by checking whether the
username exists in the system. If not, we will return nullptr inside
verifyMtls function, which result in 401 unauthorized response if the
user have valid format of certificate, but there is no related username
inside the system

Change-Id: I479a10ed2bcce2c9969e19fa3aab9686ba4c71be
Signed-off-by: Malik Akbar Hashemi Rafsanjani <malikrafsan@meta.com>
Signed-off-by: Ed Tanous <etanous@nvidia.com>

show more ...

Add back include cleaner

Include cleaner helps the code review process. Add it back, by ignoring
some of the more recent boost headers.

Change-Id: I6eddd0e67cd9f469c93fbb344cc1ab46231e450f
Signed-

Add back include cleaner

Include cleaner helps the code review process. Add it back, by ignoring
some of the more recent boost headers.

Change-Id: I6eddd0e67cd9f469c93fbb344cc1ab46231e450f
Signed-off-by: Ed Tanous <etanous@nvidia.com>

show more ...

Add PowerWatts for EnvironmentMetrics

The EnvironmentMetrics schema[1] provides for efficient retrieval of
environmental metrics by separating them from performance metrics.
EnvironmentMetrics is a

Add PowerWatts for EnvironmentMetrics

The EnvironmentMetrics schema[1] provides for efficient retrieval of
environmental metrics by separating them from performance metrics.
EnvironmentMetrics is a property of the Chassis schema since v1_15_0[2].
EnvironmentMetrics was added to Redfish release 2021.2 [3] to be used
instead of the deprecated Power schema.[4]

This commit adds PowerWatts property of the EnvironmentMetrics schema.
PowerWatts has been part of the EnvironmentMetrics schema since v1_1_0.
PowerWatts is a SensorPowerExcerpt[5].

Implementation notes: The new D-Bus interface
"xyz.openbmc_project.Sensor.Purpose" is used to find the sensor with the
"TotalPower" purpose.[6][7] The new utility function
sensor_utils::getSensorsByPurpose() returns a subset of an incoming list
of sensors which implement a specified purpose.

Multiple D-Bus calls are needed to find the sensor providing the
totalPower:
1. Retrieve list of power sensors associated with specified chassis
which implement the Sensor.Purpose interface using existing
getAllSensorObjects() function.
2. For each of those power sensors retrieve the actual purpose of the
sensor to find the sensor implementing totalPower purpose. Expect no
more than one sensor to implement this purpose. New utility function
getSensorsByPurpose() is used.
3. If a totalPower sensor is found then retrieve its properties to fill
in PowerWatts in the response using existing
sensor_utils::objectExcerptToJson() utility function.

If no sensor has the "TotalPower" purpose then PowerWatts is
not added to EnvironmentMetrics and no error is returned.

[1] https://redfish.dmtf.org/schemas/v1/EnvironmentMetrics.v1_3_2.json
[2] https://redfish.dmtf.org/schemas/v1/Chassis.v1_25_2.json
[3] http://redfish.dmtf.org/schemas/Redfish_Release_History.pdf
[4] https://redfish.dmtf.org/schemas/v1/Power.v1_7_3.json
[5] http://redfish.dmtf.org/schemas/v1/Sensor.v1_9_1.json#/definitions/SensorPowerExcerpt
[6] https://gerrit.openbmc.org/c/openbmc/phosphor-dbus-interfaces/+/75943
[7] https://gerrit.openbmc.org/c/openbmc/openpower-occ-control/+/77408

Tested:
- Updated unit tests for new environmentMetricsNode enum
- Redfish Service Validator passes (confirmed PowerWatts tested)
```
VERBOSE1 - ServiceRoot -> Chassis -> Members#4 -> EnvironmentMetrics, EnvironmentMetrics.v1_3_0, EnvironmentMetrics
VERBOSE1 - @odata.id PASS
VERBOSE1 - @odata.type PASS
VERBOSE1 - Id PASS
VERBOSE1 - Name PASS
VERBOSE1 - PowerWatts PASS
```
- No "TotalPower" sensor exists (system never powered on).
PowerWatts is not shown and no error is returned.
```
curl -k -H "X-Auth-Token: $token" https://${bmc}/redfish/v1/Chassis/chassis/EnvironmentMetrics
{
"@odata.id": "/redfish/v1/Chassis/chassis/EnvironmentMetrics",
"@odata.type": "#EnvironmentMetrics.v1_3_0.EnvironmentMetrics",
"Id": "EnvironmentMetrics",
"Name": "Chassis Environment Metrics"
}
```

- "TotalPower" sensor exists (system powered on)
```
curl -k -H "X-Auth-Token: $token" https://${bmc}/redfish/v1/Systems/system | grep PowerState
"PowerState": "On",

curl -k -H "X-Auth-Token: $token" https://${bmc}/redfish/v1/Chassis/chassis/EnvironmentMetrics
{
"@odata.id": "/redfish/v1/Chassis/chassis/EnvironmentMetrics",
"@odata.type": "#EnvironmentMetrics.v1_3_0.EnvironmentMetrics",
"Id": "EnvironmentMetrics",
"Name": "Chassis Environment Metrics",
"PowerWatts": {
"DataSourceUri": "/redfish/v1/Chassis/chassis/Sensors/power_total_power",
"Reading": 191.0
}
}
```
DataSourceUri is a valid sensor:
```
curl -k -H "X-Auth-Token: $token" https://${bmc}/redfish/v1/Chassis/chassis/Sensors/power_total_power
{
"@odata.id": "/redfish/v1/Chassis/chassis/Sensors/power_total_power",
"@odata.type": "#Sensor.v1_2_0.Sensor",
"Id": "power_total_power",
"Name": "total power",
"Reading": 191.0,
"ReadingType": "Power",
"ReadingUnits": "W",
"Status": {
"Health": "OK",
"State": "Enabled"
}
}
```

- "TotalPower" sensor exists but null value (system powered off)
```
curl -k -H "X-Auth-Token: $token" https://${bmc}/redfish/v1/Systems/system | grep PowerState
"PowerState": "Off",

curl -k -H "X-Auth-Token: $token" https://${bmc}/redfish/v1/Chassis/chassis/EnvironmentMetrics
{
"@odata.id": "/redfish/v1/Chassis/chassis/EnvironmentMetrics",
"@odata.type": "#EnvironmentMetrics.v1_3_0.EnvironmentMetrics",
"Id": "EnvironmentMetrics",
"Name": "Chassis Environment Metrics",
"PowerWatts": {
"DataSourceUri": "/redfish/v1/Chassis/chassis/Sensors/power_total_power",
"Reading": null
}
}
```

And again the DataSourceUri points to a valid sensor:
```
curl -k -H "X-Auth-Token: $token" https://${bmc}/redfish/v1/Chassis/chassis/Sensors/power_total_power
{
"@odata.id": "/redfish/v1/Chassis/chassis/Sensors/power_total_power",
"@odata.type": "#Sensor.v1_2_0.Sensor",
"Id": "power_total_power",
"Name": "total power",
"Reading": null,
"ReadingType": "Power",
"ReadingUnits": "W",
"Status": {
"Health": "OK",
"State": "Enabled"
}
}
```

- Invalid chassis id ("TotalPower" sensor exists)
```
curl -k -H "X-Auth-Token: $token" https://${bmc}/redfish/v1/Chassis/chassisBAD/EnvironmentMetrics
{
"error": {
"@Message.ExtendedInfo": [
{
"@odata.type": "#Message.v1_1_1.Message",
"Message": "The requested resource of type Chassis named 'chassisBAD' was not found.",
"MessageArgs": [
"Chassis",
"chassisBAD"
],
"MessageId": "Base.1.19.ResourceNotFound",
"MessageSeverity": "Critical",
"Resolution": "Provide a valid resource identifier and resubmit the request."
}
],
"code": "Base.1.19.ResourceNotFound",
"message": "The requested resource of type Chassis named 'chassisBAD' was not found."
}
}
```

Signed-off-by: George Liu <liuxiwei@inspur.com>
Signed-off-by: Janet Adkins <janeta@us.ibm.com>
Change-Id: Ibe84a5e7fe0d2b232f925e457a094c021ca85d36

show more ...

Add unit test for createBasicAuthHeader

The test verifies proper Basic Authentication
header generation and Base64 encoding/decoding

Tested: Unit test passes
Change-Id: I4c4ae7e30b1d781967208849a19

Add unit test for createBasicAuthHeader

The test verifies proper Basic Authentication
header generation and Base64 encoding/decoding

Tested: Unit test passes
Change-Id: I4c4ae7e30b1d781967208849a1919021e69a0b65
Signed-off-by: Kamran Hasan <khasan@nvidia.com>

show more ...

Remove getNthStringFromPath function

This utility function is being removed for several reasons. First, it
does not verify the full string on URIs and paths, so things like
/foo/bar/baz/valid_id wo

Remove getNthStringFromPath function

This utility function is being removed for several reasons. First, it
does not verify the full string on URIs and paths, so things like
/foo/bar/baz/valid_id would still pass this check.

Second, it is used for both URIs and dbus paths, both of which we have
better utility functions these days respectively, boost::url for urls
and sdbusplus::message::object_path for dbus paths. Neither of the two
is escaped properly when this function is used.

Therefore, remove it and replace it with the appropriate alternatives.

The existing URI functions were found to not accept fragments (given
they are rarely used in PATCH). Add support for fragments to cover the
getNthStringFromPath use cases.

Tested: Redfish service validator passes.

Change-Id: Ibc6755ad69397123d7fef0e0b764042bbb48888b
Signed-off-by: Ed Tanous <etanous@nvidia.com>

show more ...

Tune http2 window and frame sizes

http2 maintains its own frame ACK window per stream. While the defaults
work well in most cases, for large binary uploads, like Redfish
UpdateService, the relative

Tune http2 window and frame sizes

http2 maintains its own frame ACK window per stream. While the defaults
work well in most cases, for large binary uploads, like Redfish
UpdateService, the relatively small default window size of 16KB leads to
slower performance than http1. While it's not expected to see a
performance improvement, we would prefer to not see a regression for a
normal use case.

Update the HTTP2 max frame size to 16KB. Setting the internal buffer to
the same size + the http2 header allows clocking in the entire frame in
one async read. Note, setting the value higher than 16KB doesn't appear
to allow curl to send larger frames.

Also update the HTTP window size to 512KB, or 32 times the max frame
size. Note, all streams including the control stream are set to this
value, which, while somewhat arbitrary, allows for continued
UpdateService pushing without pauses for window ACK.

Tested:
POST /redfish/v1/UpdateService/update-multipart
Of an arbitrary 100MB file through curl shows that --http1.1 option and
--http2 option are within 5% of the same upload time.

Change-Id: I7ff6296a9cc0794aad63f5058620c0f1fb9299e3
Signed-off-by: Ed Tanous <etanous@nvidia.com>

show more ...

Filter http2 headers

When using aggregation with http2, :authority headers were getting
forwarded to the client, which didn't know how to deal with them on
http1.

Filter all http2 headers.

Tested:

Filter http2 headers

When using aggregation with http2, :authority headers were getting
forwarded to the client, which didn't know how to deal with them on
http1.

Filter all http2 headers.

Tested: Unit tests pass.

Change-Id: I6a834656b604004eeba1a2aa2f245ef211f28495
Signed-off-by: Ed Tanous <etanous@nvidia.com>

show more ...

Make unit tests use arrays

When these tests hit failures, splitting up these frames makes it a lot
easier to debug.

Tested: Unit tests pass

Change-Id: I29f5906c2f7aa90d0bd9989ba9f9d2525987f4d9
Sig

Make unit tests use arrays

When these tests hit failures, splitting up these frames makes it a lot
easier to debug.

Tested: Unit tests pass

Change-Id: I29f5906c2f7aa90d0bd9989ba9f9d2525987f4d9
Signed-off-by: Ed Tanous <etanous@nvidia.com>

show more ...

Remove deprecated json decodes

These decodes haven't been standard practice for a while. While they
will likely break some downstream builds, we need to clean things up.

If you are seeing this com

Remove deprecated json decodes

These decodes haven't been standard practice for a while. While they
will likely break some downstream builds, we need to clean things up.

If you are seeing this commit message because your downstream build is
broken, please migrate your code to using nlohmann::json::object_t
instead of nlohmann::json when it does the unpack.

Tested: Code compiles.

Change-Id: Id892ee381b2d6b40a6366ee0622cde04d2cacd7b
Signed-off-by: Ed Tanous <etanous@nvidia.com>

show more ...

Add check to omit `DateTime` from etag calculation

Ignores any json property named `DateTime` when calculating
the etag value of an HTTP response as per the updated
Redfish Spec (section 6.5: ETags)

Add check to omit `DateTime` from etag calculation

Ignores any json property named `DateTime` when calculating
the etag value of an HTTP response as per the updated
Redfish Spec (section 6.5: ETags)

Tested:
- Redfish Service Validator passes
- Tested on romulus:
1. GET resource with a "DateTime" field
```
curl -k -H "X-Auth-Token: $XAUTH_TOKEN" "https://$BMC/redfish/v1/TaskService" \
--etag-save ./etag.txt -v
...
< etag: "6A4CE897"
...
{
"@odata.id": "/redfish/v1/TaskService",
"@odata.type": "#TaskService.v1_1_4.TaskService",
"CompletedTaskOverWritePolicy": "Oldest",
"DateTime": "2025-07-23T17:08:20+00:00",
"Id": "TaskService",
"LifeCycleEventOnTaskStateChange": true,
"Name": "Task Service",
"ServiceEnabled": true,
"Status": {
"State": "Enabled"
},
"Tasks": {
"@odata.id": "/redfish/v1/TaskService/Tasks"
}
```

2. GET same resource again later, etag is same as before
```
curl -k -H "X-Auth-Token: $XAUTH_TOKEN" "https://$BMC/redfish/v1/TaskService" \
--etag-save ./etag.txt -v
...
< etag: "6A4CE897"
...
{
"@odata.id": "/redfish/v1/TaskService",
"@odata.type": "#TaskService.v1_1_4.TaskService",
"CompletedTaskOverWritePolicy": "Oldest",
"DateTime": "2025-07-23T17:10:48+00:00",
"Id": "TaskService",
"LifeCycleEventOnTaskStateChange": true,
"Name": "Task Service",
"ServiceEnabled": true,
"Status": {
"State": "Enabled"
},
"Tasks": {
"@odata.id": "/redfish/v1/TaskService/Tasks"
}
```
"DateTime" is the only value to have changed, but since
it is ignored the etag did not change

3. GET with if-none-match returns 304
```
curl -k -H "X-Auth-Token: $XAUTH_TOKEN" "https://$BMC/redfish/v1/TaskService" \
--etag-save ./etag.txt --etag-compare ./etag.txt -v
...
> if-none-match: "6A4CE897"
...
< HTTP/2 304
< allow: GET
< odata-version: 4.0
< strict-transport-security: max-age=31536000; includeSubdomains
< pragma: no-cache
< cache-control: no-store, max-age=0
< x-content-type-options: nosniff
< etag: "6A4CE897"
< date: Wed, 23 Jul 2025 17:14:39 GMT
< content-length: 0
<
...
```

Change-Id: I51f7668e75719c69c55535e4a1e48c8bae7c9488
Signed-off-by: Corey Ethington <cethington@coreweave.com>

show more ...