Fix for ipmiUserSetUserName

Corrected ipmiUserSetUserName API signature

Tested:
1. Set username
Command: ipmitool -I lanplus -C 3 -p 623 -U root -P <password> -H <BMC-IP> user
set name 5 WIJGueNK
R

Fix for ipmiUserSetUserName

Corrected ipmiUserSetUserName API signature

Tested:
1. Set username
Command: ipmitool -I lanplus -C 3 -p 623 -U root -P <password> -H <BMC-IP> user
set name 5 WIJGueNK
Response: //Success
2. List users
ipmitool user list 1
ID Name Callin Link Auth IPMI Msg Channel Priv Limit
1 root false true true ADMINISTRATOR
2 true false false NO ACCESS
3 true false false NO ACCESS
4 true false false NO ACCESS
5 WIJGueNK true false false NO ACCESS

Signed-off-by: jayaprakash Mutyala <mutyalax.jayaprakash@intel.com>
Change-Id: I09e849478cc75c88ed7389633c3002d75f1c9b09

show more ...

user_channel:Change fun ret&cmd cc as per New Std

Modified ipmi function return status code and
command completion codes as per new standard.

Tested:
verified using ipmitool commands.
1. create new

user_channel:Change fun ret&cmd cc as per New Std

Modified ipmi function return status code and
command completion codes as per new standard.

Tested:
verified using ipmitool commands.
1. create new user
Command : ipmitool user set name 5 user5
Response: //user created successfully
Command: ipmitool user set password 5 0penBmc\' //set password
Response: Set User Password command successful (user 5)

2. Set password
Command : ipmitool user set password 5 0penBmc\'
Response: Set User Password command successful (user 5)

3. set channel access
Command: ipmitool channel setaccess 1 5 callin=on ipmi=on link=on
privilege=4
Response: Set User Access (channel 1 id 5) successful.

4. get channel access
Command: ipmitool channel getaccess 1 5
Response:
Maximum User IDs : 15
Enabled User IDs : 5

User ID : 5
User Name : user5
Fixed Name : No
Access Available : call-in / callback
Link Authentication : enabled
IPMI Messaging : enabled
Privilege Level : ADMINISTRATOR
Enable Status : disabled

5. User list
Command: ipmitool user list 1
Response:
ID Name Callin Link Auth IPMI Msg Channel Priv Limit
1 root false true true ADMINISTRATOR
2 putty_operator true true true OPERATOR
3 ipmi_admin true true true ADMINISTRATOR
4 user2 false true true OPERATOR
5 user5 true true true ADMINISTRATOR
6 true false false NO ACCESS
7 true false false NO ACCESS
8 true false false NO ACCESS
9 true false false NO ACCESS
10 true false false NO ACCESS
11 true false false NO ACCESS
12 true false false NO ACCESS
13 true false false NO ACCESS
14 true false false NO ACCESS
15 true false false NO ACCESS

Signed-off-by: jayaprakash Mutyala <mutyalax.jayaprakash@intel.com>
Signed-off-by: NITIN SHARMA <nitin1x.sharma@intel.com>
Change-Id: I5f2c32f50edc2de204ac361364e21a61a4bcf237

show more ...

[channel-mgmt]: Handle out of range error in path

Function must assume that object path without any network name
may be advertised, and must handle the condition accordingly.

Tested:
1. Verified th

[channel-mgmt]: Handle out of range error in path

Function must assume that object path without any network name
may be advertised, and must handle the condition accordingly.

Tested:
1. Verified that ipmi user is properly enabled with channel
based permission and it works fine.

Change-Id: Id51f09bb7c19a9750cb06c2c55f7271afc6b1d2a
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

show more ...

[user-mgmt]: Handle out of range error in path

Function must assume that object path without user name may exist,
and must handle the condition accordingly.

Tested:
1. Verified when InterfacesAdded

[user-mgmt]: Handle out of range error in path

Function must assume that object path without user name may exist,
and must handle the condition accordingly.

Tested:
1. Verified when InterfacesAdded signal sent out from Phosphor-user-manager
under base user object for global attributes, ipmid is not crashed.

Resolves openbmc/phosphor-net-ipmid#10

Change-Id: Ib19af7ca8f05fd9f4553010caf347c677d9897e2
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

show more ...

[channel-mgmt]: Misc fixes for log messge tag.

Fixed wrong log entry tags to list the entries properly.

Tested: Verified it is comming in journalctl logs

Change-Id: I5352f9f87eb43414b4b04335ba4321

[channel-mgmt]: Misc fixes for log messge tag.

Fixed wrong log entry tags to list the entries properly.

Tested: Verified it is comming in journalctl logs

Change-Id: I5352f9f87eb43414b4b04335ba43219e452785c6
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

show more ...

[Fix]: Check ipmi groups list before creating user

When phosphor-user-manager is started later than ipmid,
then ipmid misses to get the AvailableGroups list from
phosphor-user-manager. Further creat

[Fix]: Check ipmi groups list before creating user

When phosphor-user-manager is started later than ipmid,
then ipmid misses to get the AvailableGroups list from
phosphor-user-manager. Further creation of user through ipmi
will end up creating user which doesn't belong to any group
at all. This fixes, by making sure, ipmi creates user only
if ipmi group is in available groups lists, and will do
re-query if it is empty.

Tested:
1. Verified the user creation behaviour with having dependency to
phosphor-user-manager and without.
2. Manually tested the following.
a. Stopped phosphor-user-manager & all ipmi
b. Started phosphor-host-ipmid
c. started phosphor-user-manager
d. using ipmitool user set name created user and verified that it
belongs to proper group as expected.

Change-Id: I5810babda0e70eb7b6bca577af2031da90dbb068
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

show more ...

[user-mgmt]: Do late initialization of user init.

When dependency with phosphor-user-manager is removed from host-ipmid,
both the daemons can start on it's own pace, causing host-ipmid to
miss both

[user-mgmt]: Do late initialization of user init.

When dependency with phosphor-user-manager is removed from host-ipmid,
both the daemons can start on it's own pace, causing host-ipmid to
miss both GetManagedObjects query and signal capture, as host-ipmid
is busy in doing the initialization. Updated code, such that user
initialization is posted and executed as part of io schedule.

Tested:
1. Verified that user list are properly listed after this change.
Note: Also, performed following tests to determine the order didn't cause any
problem. Verified with both ipmi_user.json deleted and preserved.
2. Started phosphor-user-manager after host-ipmid
3. Re-started phosphor-user-manager.
4. Started phosphor-host-ipmid after phosphor-user-manager.
5. Restarted phosphor-host-ipmid.
6. Added sleep code to force the scenario of GetManagedObjects fails, and
signals are captured. and GetManagedObject passes (when both are started).

Change-Id: Id5cc6ada6dd3472ddfd8803c49cd4a2a7fb6c58b
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

show more ...

[user-mgmt]: Rearrange signal handler registration

Currently, signal handler are registered after the GetManagedObjects
query. This may miss any signals generated in-between this time. Correct
flow

[user-mgmt]: Rearrange signal handler registration

Currently, signal handler are registered after the GetManagedObjects
query. This may miss any signals generated in-between this time. Correct
flow must be to register for the signal first, followed by
GetManagedObjects query.

Tested:
1. Verified that user list are properly listed after this change.
Note: Also, performed following tests to determine the order didn't cause any
problem. Verified with both ipmi_user.json deleted and preserved.
2. Started phosphor-user-manager after host-ipmid.
3. Re-started phosphor-user-manager.
4. Started phosphor-host-ipmid after phosphor-user-manager.
5. Restarted phosphor-host-ipmid.

Change-Id: I124b5e96672e0456289bca7a2b889e4b897c0545
Signed-off-by: arun-pm <arun.p.m@linux.intel.com>

show more ...

user_mgmt:password authentication/update by PAM

Allowed password characters will be handled by password management,
instead of set user password command. This makes the checking to be
moved from set

user_mgmt:password authentication/update by PAM

Allowed password characters will be handled by password management,
instead of set user password command. This makes the checking to be
moved from set user password command to pam layer and accordingly
throw error, when the same is not valid.

Fix: So modified the code to handle with pam module itself.

Tested:
ipmitool user set password 6 0penBmc1\'
Set User Password command successful (user 6)

ipmitool user set password 6 0penBmc1\"
Set User Password command successful (user 6)

ipmitool user set password 6 12345678 //invalid password
IPMI command failed: Invalid data field in request
Set User Password command failed (user 6)

ipmitool user set password 3 asdf1234 //user id does not exit
IPMI command failed: Unspecified error
Set User Password command failed (user 3)

Signed-off-by: jayaprakash Mutyala <mutyalax.jayaprakash@intel.com>
Change-Id: Iba6e2c29a927d53e6ebdb5d32e83ecc7cbbd2fd0

show more ...

channelcmds:fix set chnl access sessionless chnl

Return proper error code 0x82 for session-less channel

Tested
1.verified with ipmitool raw commands

ipmitool raw 0x06 0x40 0x00 0x40 0x04
Unable to

channelcmds:fix set chnl access sessionless chnl

Return proper error code 0x82 for session-less channel

Tested
1.verified with ipmitool raw commands

ipmitool raw 0x06 0x40 0x00 0x40 0x04
Unable to send RAW command (channel=0x0 netfn=0x6 lun=0x0 cmd=0x40
rsp=0x82): Unknown (0x82)

ipmitool raw 0x06 0x41 0x00 0x40
Unable to send RAW command (channel=0x0 netfn=0x6 lun=0x0 cmd=0x41
rsp=0x82): Unknown (0x82)

Signed-off-by: anil kumar appana <anil.kumarx.appana@intel.com>
Change-Id: I9ada001427a6c3dcaaf6de026f8831faa54c182d

show more ...

Clean-up: entry code msgs in user_channel cpp files

Cleaning up phosphor logging entry messages from
the usage of ':' to '=' in the whole user_channel
dir cpp files.

Signed-off-by: Ayushi Smriti <s

Clean-up: entry code msgs in user_channel cpp files

Cleaning up phosphor logging entry messages from
the usage of ':' to '=' in the whole user_channel
dir cpp files.

Signed-off-by: Ayushi Smriti <smriti.ayushi@linux.intel.com>
Change-Id: Ifa8eb35751279cf6bebd876105b7a4d24deb98a0

show more ...

Channel: Fix atomic lock issue for file copy

Atomic lock was missing in between volatile / non-volatile
channel configuration check and restore. This was causing
random failure when instances init c

Channel: Fix atomic lock issue for file copy

Atomic lock was missing in between volatile / non-volatile
channel configuration check and restore. This was causing
random failure when instances init channel management code.
Fixed the same, by having a lock for init channel.

Tested:
1. Verified that existing ipmitool commands still works
including user & channel commands
2. Verified that random failure doesn't happen.

Change-Id: I612917ea1a767e353d0b16b7dd9144e0e99d46e7
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

show more ...

Static code analysis scan issue fix

Fix the issues found during code static scan

Tested:
test in board, function works fine.
1. busctl set-property for watchdog, it works fine.
2. It works by runni

Static code analysis scan issue fix

Fix the issues found during code static scan

Tested:
test in board, function works fine.
1. busctl set-property for watchdog, it works fine.
2. It works by running "ipmitool chassis power soft".
3. run "ipmitool raw 0x6 0x46 1", get expected user information.

Change-Id: I7a2cc3c934db6a7531f8a8ea05956cb6d6337633
Signed-off-by: Chen,Yugang <yugang.chen@linux.intel.com>

show more ...

user_channel: passwd_mgr: minor cleanup from cppcheck

[user_channel/passwd_mgr.cpp:220]: (style) The scope of the
variable 'userEPos' can be reduced.
[user_channel/passwd_mgr.cpp:358]: (style) The s

user_channel: passwd_mgr: minor cleanup from cppcheck

[user_channel/passwd_mgr.cpp:220]: (style) The scope of the
variable 'userEPos' can be reduced.
[user_channel/passwd_mgr.cpp:358]: (style) The scope of the
variable 'userEPos' can be reduced.
[user_channel/passwd_mgr.cpp:444]: (style) Variable 'fd' is
assigned a value that is never used.

Tested: Not tested.
Signed-off-by: Patrick Venture <venture@google.com>
Change-Id: If02125c422ab1e9c15c6420dbf8da6a52fb68541

show more ...

user_channel: user_mgmt: minor cleanup from cppcheck

[user_channel/user_mgmt.cpp:1628]: (style) The scope
of the variable 'usrEnabled' can be reduced.
[user_channel/user_mgmt.cpp:310]: (style) Unuse

user_channel: user_mgmt: minor cleanup from cppcheck

[user_channel/user_mgmt.cpp:1628]: (style) The scope
of the variable 'usrEnabled' can be reduced.
[user_channel/user_mgmt.cpp:310]: (style) Unused variable: update

Tested: Not tested.
Signed-off-by: Patrick Venture <venture@google.com>
Change-Id: Id38469ab5d5b0fa9c512f5a77fff1f1372e794c2

show more ...

user_mgmt: update default ipmi_user.json file.

By default, Serial Over LAN (SOL) payload access should be enabled
for all users in all channels. Ensure that this clause is met when
default ipmi_use

user_mgmt: update default ipmi_user.json file.

By default, Serial Over LAN (SOL) payload access should be enabled
for all users in all channels. Ensure that this clause is met when
default ipmi_user.json file is created, usually because of BMC
re-flashing.

Tested-by:
1. Check SOL payload access values in ipmi_user.json after reflashing.

// Command - grep "std_payload1" /var/lib/ipmi/ipmi_user.json
// Response - OK.
...
"payload_enabled":{..."std_payload1":[true,true,...]...},
...

2. Check SOL payload access values in ipmi_user.json after BMC FW update
// Command and Response same as (1.). OK.
// ipmi_user.json file is updated upon its first write after FW update.

Signed-off-by: Saravanan Palanisamy <saravanan.palanisamy@linux.intel.com>
Change-Id: I604aac6d000eac40a3a3460ea46c6fe81d285dee

show more ...

user_mgmt: Enable SOL payload access by default.

Enabling SOL payload access for all users in all channels, by default.
It is not mandated by IPMI spec, but needed for backward-compatibility.

Teste

user_mgmt: Enable SOL payload access by default.

Enabling SOL payload access for all users in all channels, by default.
It is not mandated by IPMI spec, but needed for backward-compatibility.

Tested-by:
1. Run Get User Payload Access Command for random user on LAN channel.
// Command - (channel 3 is of LAN channel type)
ipmitool -I lanplus...raw 0x06 0x4D 3 7
02 00 00 00 // Response

2. Disable SOL payload and rerun Get User Payload Access Command.
// Command
ipmitool -I lanplus...raw 0x06 0x4C 3 0x48 0x02 0 0x00 0
ipmitool -I lanplus...raw 0x06 0x4D 3 8
00 00 00 00 // Response

3. Run Get User Payload Access on non-LAN, session-less channel.
// Command - (channel 7 is KCS channel type)
ipmitool -I lanplus...raw 0x06 0x4D 7 7
Error:(...rsp=0xcc): Invalid data field in request // Response

4. Check SOL session activation and 'ipmi_user.json' file contents.

Change-Id: I48c50e6366a0025d5ae066c8a8f3694d2f710732
Signed-off-by: Saravanan Palanisamy <saravanan.palanisamy@linux.intel.com>

show more ...

user_layer: Add get/set user payload access.

IPMI Spec reference: Section 24.6, 24.7.
Support is added to get/set user access details for the
unreserved, supported payload types defined by Spec.
SOL

user_layer: Add get/set user payload access.

IPMI Spec reference: Section 24.6, 24.7.
Support is added to get/set user access details for the
unreserved, supported payload types defined by Spec.
SOL is the only unreserved, supported payload currently.
If support is needed for unreserved std/oem payload
types in future, they can be enabled with minor source code
changes to this implementation.

All payload types are packed in a JSON object
"payload_enabled" in ipmi_user.json file.

Tested-by:
1. For user 8 in channel 3, Enable SOL payload.

// Command - (channel 3 is of LAN channel type)
ipmitool -I lanplus...raw 0x06 0x4C 3 0x8 0x02 0 0 0
// Verify it with Get User Payload Access Command
ipmitool -I lanplus...raw 0x06 0x4D 3 8
02 00 00 00 // Response

2. Disable SOL payload.

// Command
ipmitool -I lanplus...raw 0x06 0x4C 3 0x48 0x02 0 0x00 0
// Verify it with Get User Payload Access Command
ipmitool -I lanplus...raw 0x06 0x4D 3 8
00 00 00 00 // Response

3. Enable unsupported payload stdPayload7.

// Command
ipmitool -I lanplus...raw 0x06 0x4C 3 0x8 0x80 0 0 0
Error: Invalid data field in request // Response

Change-Id: Idc57b04a747e55666407d928d8b2169223501e5b
Signed-off-by: Saravanan Palanisamy <saravanan.palanisamy@linux.intel.com>

show more ...

Add an option to exclude libuserlayer from host-ipmid

Change-Id: I8e14cfd3719c7fbef739f2aa01771bc4321ce290
Signed-off-by: Ofer Yehielli <ofery@google.com>
Tested: Enabled the exclude libuserlayer fl

Add an option to exclude libuserlayer from host-ipmid

Change-Id: I8e14cfd3719c7fbef739f2aa01771bc4321ce290
Signed-off-by: Ofer Yehielli <ofery@google.com>
Tested: Enabled the exclude libuserlayer flag in
recipes-phosphor/ipmi/phosphor-ipmi-host_%.bbappend
+EXTRA_OECONF_append_xxx = " --disable-libuserlayer"
+HOSTIPMI_PROVIDER_LIBRARY_remove_xxx = "libusercmds.so"
+NETIPMI_PROVIDER_LIBRARY_remove_xxx = "libusercmds.so"
Clean build and test that userlayer.so doesn't get included in the build

show more ...

Remove unused function convertCurrentChannelNum(uint8_t)

convertCurrentChannelNum(uint8_t) was deprecated in favor of an
actual working implementation. It was stubbed out for a while to
provide a br

Remove unused function convertCurrentChannelNum(uint8_t)

convertCurrentChannelNum(uint8_t) was deprecated in favor of an
actual working implementation. It was stubbed out for a while to
provide a broken, backwards-compatible interface, but now that all
of those have been removed in favor of the new interface that
actually works: convertCurrentChannelNum(uint8_t, uint8_t), the
old function can be removed.

Tested: Builds without any errors (means the old interface was removed)

Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>
Change-Id: I3796e890c7cc34333116b71a97db268abf5f0e89

show more ...

Add get channel payload version command

Implement get channel payload version command (IPMI specification
section 24.9). As per the specification, this command is basically a
hard-coded value that s

Add get channel payload version command

Implement get channel payload version command (IPMI specification
section 24.9). As per the specification, this command is basically a
hard-coded value that says we are using IPMI 2.0.

Tested:
ipmitool raw 6 0x4F 3 1 // Command
10 // Response

Change-Id: Id16723e7257361814b98f3c14d759f2919ad4c03
Signed-off-by: Ayushi Smriti <smriti.ayushi@intel.com>
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>

show more ...

user_channel: Get Channel Payload Support command refactor

Update the get channel payload support command to use the new IPMI API.
This simplifies the code as well as adds support for the special IP

user_channel: Get Channel Payload Support command refactor

Update the get channel payload support command to use the new IPMI API.
This simplifies the code as well as adds support for the special IPMI
channel 0x0e.

Tested: ipmitool -I lanplus -H ... -U ... raw 6 0x4e 0xe
03 00 3f 00 00 00 00 00
ipmitool -I lanplus -H ... -U ... raw 6 0x4e 1
03 00 3f 00 00 00 00 00

Change-Id: I8b67d6f79c40299b4b653212a2f1f9d0c1a9087c
Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>

show more ...

user_mgmt: Fix error message with file name

Updated error message with proper config file name

Tested:
Verified that file name is properly listed in error message

Change-Id: I0c2552000f704f3b4b541

user_mgmt: Fix error message with file name

Updated error message with proper config file name

Tested:
Verified that file name is properly listed in error message

Change-Id: I0c2552000f704f3b4b541b8fe90adec966a6616a
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

show more ...

User-mgmt: Add IPMI user pam authenticate check API

PAM user authentication check must be performed, before any RMCP+
session establishment, as this will be able to check whether user
is already loc

User-mgmt: Add IPMI user pam authenticate check API

PAM user authentication check must be performed, before any RMCP+
session establishment, as this will be able to check whether user
is already locked out, due to failed attempt.
This patch introduces the pam user check API, which will be used by
netipmid daemon.

Tested:
Verified the API call check and making sure it works.
Real testing is performed by including the same in
phosphor-ipmi-net for RMCP+ session establishment both
for user locked for failed attempt and normal case.

Commands used-
Created new user using ipmitool

ipmitool user set name 2 testuser
ipmitool user enable 2
ipmitool user set password 2 pas1tes2
ipmitool user priv 2 4 3

ipmitool user list 3 //New user entry can be seen listed

ipmitool channel getaccess 3 2 //For getting channel access
ipmitool channel setaccess 3 2 ipmi=on priviledge=4

Normal Case:
ipmitool -I lanplus -U testuser -P pas1tes2 -H <bmc ip> raw 6 1
//Command
23 00 00 00 02 bf 57 01 00 7b 00 00 00 00 00 //Response

Negative Case:
busctl set-property xyz.openbmc_project.User.Manager
/xyz/openbmc_project/user xyz.openbmc_project.User.AccountPolicy
MaxLoginAttemptBeforeLockout q 3

Tried 3 failed login attempts from webpage, and then tried to
establish IPMI RMCP+ as expected, session establishment failed.

wait for the timeout or unlock the user using-
busctl set-property xyz.openbmc_project.User.Manager
/xyz/openbmc_project/user/sayushi xyz.openbmc_project.User.Attributes
UserLockedForFailedAttempt b false

busctl get-property xyz.openbmc_project.User.Manager
/xyz/openbmc_project/user/sayushi xyz.openbmc_project.User.Attributes
UserLockedForFailedAttempt b false //Command
b false //Response

After this RMCP+ session will be established as usual.

Change-Id: I5ee2dc0848944a12f682f0775930091d32508bde
Signed-off-by: Ayushi Smriti <smriti.ayushi@linux.intel.com>

show more ...

Updates get channel info command to use the new provider API

Update the get channel info command to use the new IPMI provider API.
Because of the change, this command can support the use of the spec

Updates get channel info command to use the new provider API

Update the get channel info command to use the new IPMI provider API.
Because of the change, this command can support the use of the special
channel number 0x0e.

Tested-by:
(remote via RMCP+ interface)
ipmitool -I lanplus -H ... -U ... channel info
Channel 0x1 info:
Channel Medium Type : 802.3 LAN
Channel Protocol Type : IPMB-1.0
Session Support : multi-session
Active Session Count : 0
Protocol Vendor ID : 7154
Volatile(active) Settings
Alerting : disabled
Per-message Auth : enabled
User Level Auth : enabled
Access Mode : always available
Non-Volatile Settings
Alerting : disabled
Per-message Auth : enabled
User Level Auth : enabled
Access Mode : always available

(on host via kcs interface)
ipmitool channel info
Channel 0xf info:
Channel Medium Type : System Interface
Channel Protocol Type : KCS
Session Support : session-less
Active Session Count : 0
Protocol Vendor ID : 7154

Change-Id: Ica4262593acaefe12ccf70724ad4db40da344da4
Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>

show more ...