1038c52e0SEd Tanous# OpenBMC webserver # 2038c52e0SEd Tanous 3038c52e0SEd TanousThis component attempts to be a "do everything" embedded webserver for openbmc. 4038c52e0SEd Tanous 5038c52e0SEd Tanous 6038c52e0SEd Tanous## Capabilities ## 7038c52e0SEd TanousAt this time, the webserver implements a few interfaces: 8038c52e0SEd Tanous+ Authentication middleware that supports cookie and token based authentication, as well as CSRF prevention backed by linux PAM authentication credentials. 9038c52e0SEd Tanous+ An (incomplete) attempt at replicating phosphor-dbus-rest interfaces in C++. Right now, a few of the endpoint definitions work as expected, but there is still a lot of work to be done. The portions of the interface that are functional are designed to work correctly for phosphor-webui, but may not yet be complete. 10038c52e0SEd Tanous+ Replication of the rest-dbus backend interfaces to allow bmc debug to logged in users. 11038c52e0SEd Tanous+ An initial attempt at a read-only redfish interface. Currently the redfish interface targets ServiceRoot, SessionService, AccountService, Roles, and ManagersService. Some functionality here has been shimmed to make development possible. For example, there exists only a single user role. 12976596bcSJoseph Reynolds+ SSL key generation at runtime. See the configuration section for details. 13038c52e0SEd Tanous+ Static file hosting. Currently, static files are hosted from the fixed location at /usr/share/www. This is intended to allow loose coupling with yocto projects, and allow overriding static files at build time. 14038c52e0SEd Tanous+ Dbus-monitor over websocket. A generic endpoint that allows UIs to open a websocket and register for notification of events to avoid polling in single page applications. (this interface may be modified in the future due to security concerns. 15038c52e0SEd Tanous 16976596bcSJoseph Reynolds## Configuration 17976596bcSJoseph Reynolds 18976596bcSJoseph ReynoldsBMCWeb is configured by setting `-D` flags that correspond to options 19976596bcSJoseph Reynoldsin `bmcweb/CMakeLists.txt` and then compiling. For example, `cmake 20976596bcSJoseph Reynolds-DBMCWEB_ENABLE_KVM=NO ...` followed by `make`. The option names 21976596bcSJoseph Reynoldsbecome C++ preprocessor symbols that control which code is compiled 22976596bcSJoseph Reynoldsinto the program. 23976596bcSJoseph Reynolds 24976596bcSJoseph ReynoldsWhen BMCWeb starts running, it reads persistent configuration data 25976596bcSJoseph Reynolds(such as UUID and session data) from a local file. If this is not 26976596bcSJoseph Reynoldsusable, it generates a new configuration. 27976596bcSJoseph Reynolds 28976596bcSJoseph ReynoldsWhen BMCWeb SSL support is enabled and a usable certificate is not 29976596bcSJoseph Reynoldsfound, it will generate a self-sign a certificate before launching the 30*aaf3206fSVernon Maueryserver. The keys are generated by the `secp384r1` algorithm. The 31976596bcSJoseph Reynoldscertificate 3285d2bb5bSBrad Bishop - is issued by `C=US, O=OpenBMC, CN=testhost`, 33976596bcSJoseph Reynolds - is valid for 10 years, 34976596bcSJoseph Reynolds - has a random serial number, and 35976596bcSJoseph Reynolds - is signed using the `SHA-256` algorithm. 36038c52e0SEd Tanous 37