clang-format: copy latest and re-format

clang-format-16 has some backwards incompatible changes that require
additional settings for best compatibility and re-running the formatter.
Copy the latest

clang-format: copy latest and re-format

clang-format-16 has some backwards incompatible changes that require
additional settings for best compatibility and re-running the formatter.
Copy the latest .clang-format from the docs repository and reformat the
repository.

Change-Id: I44441096113929ce96eb1439e2932e6ff3c87f27
Signed-off-by: Patrick Williams <patrick@stwcx.xyz>

show more ...

Use SecureString where there is data to be cleansed

SecureString has quite a few places it should be used in the user
management code.

Tested: ran set password, test password, and other commands

C

Use SecureString where there is data to be cleansed

SecureString has quite a few places it should be used in the user
management code.

Tested: ran set password, test password, and other commands

Change-Id: Ia53bc914d25f7965c3e72d5cf18346e0fa9339b9
Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>

show more ...

user_channel: Rewriting ipmiUserSetUserName API

Rewriting ipmiUserSetUserName API

Tested:
Verified using ipmitool commands.
Command: ipmitool user set name 4 user4
Response: //Success
Command: i

user_channel: Rewriting ipmiUserSetUserName API

Rewriting ipmiUserSetUserName API

Tested:
Verified using ipmitool commands.
Command: ipmitool user set name 4 user4
Response: //Success
Command: ipmitool user set password 4 asdf1234
Response: Set User Password command successful (user 4)
Command: ipmitool user priv 4 0x03 1
Response: Set Privilege Level command successful (user 4)
Command: ipmitool user set name 14 user13asdfghkjlqwert
Response: Username is too long (> 16 bytes)
Command: ipmitool -I lanplus -C 3 -p 623 -U root -P <password> -H
<BMC-IP> user set name 8 WIJGueNKd
Response: //Success
Command: ipmitool user list 1 //User list for channel 1
1 root false true true ADMINISTRATOR
2 user2 true false false USER
3 user3 true false false NO ACCESS
4 user4 true false false OPERATOR
5 WIJGueNK true false false NO ACCESS
6 WIJGueNKb true false false NO ACCESS
7 WIJGueNKc true false false NO ACCESS
8 WIJGueNKd true false false NO ACCESS
9 true false false NO ACCESS
10 true false false NO ACCESS

Signed-off-by: jayaprakash Mutyala <mutyalax.jayaprakash@intel.com>
Change-Id: I41c091f6d9aaf54326295d1e80e16db521b2e23d

show more ...

user_channel:Change fun ret&cmd cc as per New Std

Modified ipmi function return status code and
command completion codes as per new standard.

Tested:
verified using ipmitool commands.
1. create new

user_channel:Change fun ret&cmd cc as per New Std

Modified ipmi function return status code and
command completion codes as per new standard.

Tested:
verified using ipmitool commands.
1. create new user
Command : ipmitool user set name 5 user5
Response: //user created successfully
Command: ipmitool user set password 5 0penBmc\' //set password
Response: Set User Password command successful (user 5)

2. Set password
Command : ipmitool user set password 5 0penBmc\'
Response: Set User Password command successful (user 5)

3. set channel access
Command: ipmitool channel setaccess 1 5 callin=on ipmi=on link=on
privilege=4
Response: Set User Access (channel 1 id 5) successful.

4. get channel access
Command: ipmitool channel getaccess 1 5
Response:
Maximum User IDs : 15
Enabled User IDs : 5

User ID : 5
User Name : user5
Fixed Name : No
Access Available : call-in / callback
Link Authentication : enabled
IPMI Messaging : enabled
Privilege Level : ADMINISTRATOR
Enable Status : disabled

5. User list
Command: ipmitool user list 1
Response:
ID Name Callin Link Auth IPMI Msg Channel Priv Limit
1 root false true true ADMINISTRATOR
2 putty_operator true true true OPERATOR
3 ipmi_admin true true true ADMINISTRATOR
4 user2 false true true OPERATOR
5 user5 true true true ADMINISTRATOR
6 true false false NO ACCESS
7 true false false NO ACCESS
8 true false false NO ACCESS
9 true false false NO ACCESS
10 true false false NO ACCESS
11 true false false NO ACCESS
12 true false false NO ACCESS
13 true false false NO ACCESS
14 true false false NO ACCESS
15 true false false NO ACCESS

Signed-off-by: jayaprakash Mutyala <mutyalax.jayaprakash@intel.com>
Signed-off-by: NITIN SHARMA <nitin1x.sharma@intel.com>
Change-Id: I5f2c32f50edc2de204ac361364e21a61a4bcf237

show more ...

user_layer: Add get/set user payload access.

IPMI Spec reference: Section 24.6, 24.7.
Support is added to get/set user access details for the
unreserved, supported payload types defined by Spec.
SOL

user_layer: Add get/set user payload access.

IPMI Spec reference: Section 24.6, 24.7.
Support is added to get/set user access details for the
unreserved, supported payload types defined by Spec.
SOL is the only unreserved, supported payload currently.
If support is needed for unreserved std/oem payload
types in future, they can be enabled with minor source code
changes to this implementation.

All payload types are packed in a JSON object
"payload_enabled" in ipmi_user.json file.

Tested-by:
1. For user 8 in channel 3, Enable SOL payload.

// Command - (channel 3 is of LAN channel type)
ipmitool -I lanplus...raw 0x06 0x4C 3 0x8 0x02 0 0 0
// Verify it with Get User Payload Access Command
ipmitool -I lanplus...raw 0x06 0x4D 3 8
02 00 00 00 // Response

2. Disable SOL payload.

// Command
ipmitool -I lanplus...raw 0x06 0x4C 3 0x48 0x02 0 0x00 0
// Verify it with Get User Payload Access Command
ipmitool -I lanplus...raw 0x06 0x4D 3 8
00 00 00 00 // Response

3. Enable unsupported payload stdPayload7.

// Command
ipmitool -I lanplus...raw 0x06 0x4C 3 0x8 0x80 0 0 0
Error: Invalid data field in request // Response

Change-Id: Idc57b04a747e55666407d928d8b2169223501e5b
Signed-off-by: Saravanan Palanisamy <saravanan.palanisamy@linux.intel.com>

show more ...

User-mgmt: Add IPMI user pam authenticate check API

PAM user authentication check must be performed, before any RMCP+
session establishment, as this will be able to check whether user
is already loc

User-mgmt: Add IPMI user pam authenticate check API

PAM user authentication check must be performed, before any RMCP+
session establishment, as this will be able to check whether user
is already locked out, due to failed attempt.
This patch introduces the pam user check API, which will be used by
netipmid daemon.

Tested:
Verified the API call check and making sure it works.
Real testing is performed by including the same in
phosphor-ipmi-net for RMCP+ session establishment both
for user locked for failed attempt and normal case.

Commands used-
Created new user using ipmitool

ipmitool user set name 2 testuser
ipmitool user enable 2
ipmitool user set password 2 pas1tes2
ipmitool user priv 2 4 3

ipmitool user list 3 //New user entry can be seen listed

ipmitool channel getaccess 3 2 //For getting channel access
ipmitool channel setaccess 3 2 ipmi=on priviledge=4

Normal Case:
ipmitool -I lanplus -U testuser -P pas1tes2 -H <bmc ip> raw 6 1
//Command
23 00 00 00 02 bf 57 01 00 7b 00 00 00 00 00 //Response

Negative Case:
busctl set-property xyz.openbmc_project.User.Manager
/xyz/openbmc_project/user xyz.openbmc_project.User.AccountPolicy
MaxLoginAttemptBeforeLockout q 3

Tried 3 failed login attempts from webpage, and then tried to
establish IPMI RMCP+ as expected, session establishment failed.

wait for the timeout or unlock the user using-
busctl set-property xyz.openbmc_project.User.Manager
/xyz/openbmc_project/user/sayushi xyz.openbmc_project.User.Attributes
UserLockedForFailedAttempt b false

busctl get-property xyz.openbmc_project.User.Manager
/xyz/openbmc_project/user/sayushi xyz.openbmc_project.User.Attributes
UserLockedForFailedAttempt b false //Command
b false //Response

After this RMCP+ session will be established as usual.

Change-Id: I5ee2dc0848944a12f682f0775930091d32508bde
Signed-off-by: Ayushi Smriti <smriti.ayushi@linux.intel.com>

show more ...

API support to update password for special user

Provide API support to update password for special user.
This API will be used by OEM Command to update the special
user password - linux uid 0 (root

API support to update password for special user

Provide API support to update password for special user.
This API will be used by OEM Command to update the special
user password - linux uid 0 (root user).
More details can be referred from
https://github.com/openbmc/docs/blob/master/user_management.md#deployment---out-of-factory

Tested:
1. Verified the API with OEM command implementation, and able to
configure the password for user exists in the system /etc/passwd.
2. Verified the negative case for failure

Change-Id: I3c2a7007587e52c7e713f0cd976f249dd84a5f75
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

show more ...

Adding Set Password API support in Userlayer

Moved the pam function from libusercommand to libuserlayer
Added the setPassword API in user layer.

There are modules which requires to use set password

Adding Set Password API support in Userlayer

Moved the pam function from libusercommand to libuserlayer
Added the setPassword API in user layer.

There are modules which requires to use set password functionality
(other ipmi providers-OEM),so it's better to keep the set-password
abstracted in user-layer instead of user-commands.

LIBS macro hold libpam and libmapper.
we want to separate the libpam from lib usercommand.
so,replaced LIBS with libmapper alone.

Tested:Able to set the password in ipmi using userlayer.
ex: ipmitool user set password <userid> <password>
user password should set properly.

Change-Id: I32d55ff5c042613c89805c6b9393d18cbf880461
Signed-off-by: Suryakanth Sekar <suryakanth.sekar@linux.intel.com>

show more ...

User commands updated to handle channel request

User commands updated to handle channel request properly.
1. Self channel number 0xE will be converted properly as per
the interfaces
2. Will handle c

User commands updated to handle channel request

User commands updated to handle channel request properly.
1. Self channel number 0xE will be converted properly as per
the interfaces
2. Will handle commands to set / get access for session based
channels only.

Unit-test:
Verfied get / set user access command works on self-channel
and session based channels accordingly. 0xCC will returned
for session-less channels

Change-Id: I91f610e5a70ba648a90191b7aad6ae09d4e0acdc
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

show more ...

Update const uint8_t& to const uint8_t

Update const uint8_t& to const uint8_t usage. Passing by reference
for small types are costly than passing it by value and hence the
change is done

Unit-Test

Update const uint8_t& to const uint8_t

Update const uint8_t& to const uint8_t usage. Passing by reference
for small types are costly than passing it by value and hence the
change is done

Unit-Test
1. Performed build and verified regular user account creation
and RMCP+ login

Change-Id: Ic2dd76795749148f82564677dde2a5db08520454
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

show more ...

Add test & user enabled state in set user password

Support for test password and user enabled state in Set user
password command

Unit Test:
1. Performed user enabled & disabled and verified the sta

Add test & user enabled state in set user password

Support for test password and user enabled state in Set user
password command

Unit Test:
1. Performed user enabled & disabled and verified the state change
2. Performed test user password - both pass & fail condition

Change-Id: I0eb91ad849e43072b1d9e90d777304fabdfb40bc
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

show more ...

Basic IPMI User Management Support

Squashed commit containing Basic User Management
implementation

Unit Test:
1. Verified both Host & NetIpmid works fine.
2. Verified user related command responses

Basic IPMI User Management Support

Squashed commit containing Basic User Management
implementation

Unit Test:
1. Verified both Host & NetIpmid works fine.
2. Verified user related command responses

commit b46b869c0a3958a572b976b3bbaf6b5f33673778
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Tue Aug 7 15:30:32 2018 +0530

Fix static objects to directly link user layer

User layer library has to be directly linked with netipmid
in order to be used in RAKP commands. Hence user layer
library should not initialize the static bus objects in file
scope, as ipmid_get_sd_bus_connection() won't be available
during this time. Hence moved it under function scope and
initialize it later.

Unit test:
Made sure, with this change it is loaded perfectly under
phosphor-ipmi-host & phosphor-ipmi-net and responding to
all user commands

Change-Id: Id3f2e06580ca41b0347176ca33e011bf7b048c6a
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

commit dc60516c45234379a30ad8b03b1cbe53978faeae
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Tue Aug 7 15:22:37 2018 +0530

Fix to use proper user index for set user name

Fix to use proper user index, instead of bailing out
on first empty index. If user creation is requested on
random index with previous index empty, then signal
handler updates the data in first empty index, instead of
traversing the user list fully. Fix added to mark the first
free index, and still search for match to skip if found.

Unit Test:
Verified that user added in random index shows in that index
using ipmitool set user name command.

Change-Id: I30d9b884a5bae98b243ccf8ba7da194ef81355e6
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

commit 0b9a81a1261b08ea13ad8777d0d80dad937e9972
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Fri Jul 6 15:57:02 2018 +0530

Converting json store to array for user config

Addressed comments to convert to array instead of key
value pair.

Testing: Performed basic testing of user management commands
in both host & netipmid, by repeatedly restarting the same.

Change-Id: I2e51ded3e2299fa196d868213950d96c72886358
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

commit 182c945657b29acaeb13fc44129e0ed929013e59
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Sat Jun 30 00:07:28 2018 +0530

Fix D-Bus paths for user management

Fix D-Bus path as per upstream code in user management

Change-Id: Idb22bee4365520f3d58e70ff61b02d6f6512d707
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

commit cd5e22b16f8805dda396311b06994a9e021e97e9
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Thu Jun 28 06:22:27 2018 +0530

Json format to store user config & cleanup

Code updated to use json format to store and read
the user configuration data. Few basic cleanup's
performed.

Change-Id: I7005f4f2648ccb8214312982a755ddcc6c33e64d
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

commit 95ca9a67a4b84df603db0eb6a7024e9e0e5ad342
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Wed May 30 15:16:47 2018 +0530

Get & Set User Access command implementation

Get & Set User access command implementation

Change-Id: I4f7a86de95400387c47ae556127baa1f02a703b2
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

commit b2dea762362d06b70576dba5f45552d548792cb9
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Fri May 18 23:46:23 2018 +0530

User layer separation.

Separated out user commands from the implementation details,
by creating user layers. App Handler library and netipmid
will directly rely on this user_layer.so

Change-Id: Ie7d4b3a5a934e32da73e066a25da4c27485c59c8
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

commit 63e3113e522ecc7ce6e5aa1c85de4dc9b9a65a7b
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Mon May 7 12:00:06 2018 +0530

Updated user management ipmi support

1. Relying on Object Manager & D-Bus properties signal (except
user rename, for which still relying on user rename signal)
2. Minor clean-up.

Change-Id: I594e7823a2c626bb7c88ec54a3ffa89a60b09c65
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

commit 3e7b774c842917743369569790612d74387c755e
Author: AppaRao Puli <apparao.puli@intel.com>
Date: Tue Apr 24 22:01:15 2018 +0530

Synchronize user manager data during ipmi startup

Synchronizing the user information by reading
all managed user objects from dbus and checking
ipmi user data for any update/delete/add users.

Change-Id: I9e1a62ec9dd186a7276d083a57e679606d635e05
Signed-off-by: AppaRao Puli <apparao.puli@intel.com>
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

commit 92298ac0f591d167b0e26b977316a2b136127778
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Tue Apr 24 21:34:08 2018 +0530

Minor fix: Read user enabled state in signals

Fixed to read user enabled state in signal handlers.

Change-Id: I0aa6c4687c16e08d8e304315e85cb65e9dbd346a
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

commit 8646d2683fc247ce02a0460f9577276eb6e0a581
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Wed Apr 11 22:18:44 2018 +0530

Signal handler update

Support added to handle group, privilege
user rename, enable / disable signal, and
update the database accordingly.

Change-Id: Ia33d063715a35814bbe1f9220e9609b800261e33
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

commit fa411b2c4bbef50175b084889a4829206263ebdb
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Mon Mar 12 23:42:34 2018 +0530

Add Basic user manager support - IPMI

Add basic user manager support in IPMI
Creates user through D-Bus user interface
and sets password using pam_chauthok().
Lock & File reload mechanism also implmeneted.
UserUpdate signal handler support added to update
user in IPMI, when users are updated through
different interfaces.

Change-Id: I1adc538562615109189d7c19dadae0b6a109f4a5
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

Change-Id: I1adc538562615109189d7c19dadae0b6a109f4a5
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

show more ...

IPMI password entry cleanup

Whenever user is removed from the system, password map in IPMI
database has to be cleaned up. Similarly password entry must
be updated when user rename happens. This comm

IPMI password entry cleanup

Whenever user is removed from the system, password map in IPMI
database has to be cleaned up. Similarly password entry must
be updated when user rename happens. This commit add's API
changes for the same

Change-Id: I304c721b31fc7fbad019c85d8ca2ecc60ca398d8
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

show more ...

Handling delete password entry from ipmi-pass

API to Handle the delete password entry from
ipmi-pass encrypted file when user gets deleted
by any interface

Change-Id: I692a81b166b53d6fc981fdb85ce5d

Handling delete password entry from ipmi-pass

API to Handle the delete password entry from
ipmi-pass encrypted file when user gets deleted
by any interface

Change-Id: I692a81b166b53d6fc981fdb85ce5d6980887560b
Signed-off-by: AppaRao Puli <apparao.puli@intel.com>
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

show more ...

Add first user layer support.

Exposes user layer library which will be used by both
apphandler and netipmid for RAKP. Password is decrypted
from the special file which is used by pam-ipmi.

Change-I

Add first user layer support.

Exposes user layer library which will be used by both
apphandler and netipmid for RAKP. Password is decrypted
from the special file which is used by pam-ipmi.

Change-Id: Ia6b99d4359a03843f19cd0e18f7269ad2e3cdb44
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

show more ...