18b7c156eSVernon Mauery #include <ipmi-allowlist.hpp>
28b7c156eSVernon Mauery #include <ipmid/api.hpp>
38b7c156eSVernon Mauery #include <ipmid/utils.hpp>
48b7c156eSVernon Mauery #include <phosphor-logging/log.hpp>
58b7c156eSVernon Mauery #include <xyz/openbmc_project/Control/Security/RestrictionMode/server.hpp>
68b7c156eSVernon Mauery
78b7c156eSVernon Mauery #include <algorithm>
88b7c156eSVernon Mauery #include <array>
98b7c156eSVernon Mauery
108b7c156eSVernon Mauery using namespace phosphor::logging;
118b7c156eSVernon Mauery using namespace sdbusplus::xyz::openbmc_project::Control::Security::server;
128b7c156eSVernon Mauery
138b7c156eSVernon Mauery namespace ipmi
148b7c156eSVernon Mauery {
158b7c156eSVernon Mauery
168b7c156eSVernon Mauery // put the filter provider in an unnamed namespace
178b7c156eSVernon Mauery namespace
188b7c156eSVernon Mauery {
198b7c156eSVernon Mauery
208b7c156eSVernon Mauery /** @class AllowlistFilter
218b7c156eSVernon Mauery *
228b7c156eSVernon Mauery * Class that implements an IPMI message filter based
238b7c156eSVernon Mauery * on incoming interface and a restriction mode setting
248b7c156eSVernon Mauery */
258b7c156eSVernon Mauery class AllowlistFilter
268b7c156eSVernon Mauery {
278b7c156eSVernon Mauery public:
288b7c156eSVernon Mauery AllowlistFilter();
298b7c156eSVernon Mauery ~AllowlistFilter() = default;
30b37abfb2SPatrick Williams AllowlistFilter(const AllowlistFilter&) = delete;
318b7c156eSVernon Mauery AllowlistFilter(AllowlistFilter&&) = delete;
32b37abfb2SPatrick Williams AllowlistFilter& operator=(const AllowlistFilter&) = delete;
338b7c156eSVernon Mauery AllowlistFilter& operator=(AllowlistFilter&&) = delete;
348b7c156eSVernon Mauery
358b7c156eSVernon Mauery private:
368b7c156eSVernon Mauery void postInit();
378b7c156eSVernon Mauery void cacheRestrictedAndPostCompleteMode();
388b7c156eSVernon Mauery void handleRestrictedModeChange(sdbusplus::message_t& m);
398b7c156eSVernon Mauery void handlePostCompleteChange(sdbusplus::message_t& m);
408b7c156eSVernon Mauery void updatePostComplete(const std::string& value);
418b7c156eSVernon Mauery void updateRestrictionMode(const std::string& value);
428b7c156eSVernon Mauery ipmi::Cc filterMessage(ipmi::message::Request::ptr request);
438b7c156eSVernon Mauery void handleCoreBiosDoneChange(sdbusplus::message_t& m);
448b7c156eSVernon Mauery void cacheCoreBiosDone();
458b7c156eSVernon Mauery
468b7c156eSVernon Mauery // the BMC KCS Policy Control Modes document uses different names
478b7c156eSVernon Mauery // than the RestrictionModes D-Bus interface; use aliases
488b7c156eSVernon Mauery static constexpr RestrictionMode::Modes restrictionModeAllowAll =
498b7c156eSVernon Mauery RestrictionMode::Modes::Provisioning;
508b7c156eSVernon Mauery static constexpr RestrictionMode::Modes restrictionModeRestricted =
5154d6fc70SMatt Simmering RestrictionMode::Modes::ProvisionedHostAllowlist;
528b7c156eSVernon Mauery static constexpr RestrictionMode::Modes restrictionModeDenyAll =
538b7c156eSVernon Mauery RestrictionMode::Modes::ProvisionedHostDisabled;
548b7c156eSVernon Mauery
558b7c156eSVernon Mauery RestrictionMode::Modes restrictionMode = restrictionModeRestricted;
568b7c156eSVernon Mauery bool postCompleted = true;
578b7c156eSVernon Mauery bool coreBIOSDone = true;
588b7c156eSVernon Mauery int channelSMM = -1;
598b7c156eSVernon Mauery std::shared_ptr<sdbusplus::asio::connection> bus;
608b7c156eSVernon Mauery std::unique_ptr<sdbusplus::bus::match_t> modeChangeMatch;
618b7c156eSVernon Mauery std::unique_ptr<sdbusplus::bus::match_t> modeIntfAddedMatch;
628b7c156eSVernon Mauery std::unique_ptr<sdbusplus::bus::match_t> postCompleteMatch;
638b7c156eSVernon Mauery std::unique_ptr<sdbusplus::bus::match_t> postCompleteIntfAddedMatch;
648b7c156eSVernon Mauery std::unique_ptr<sdbusplus::bus::match_t> platStateChangeMatch;
658b7c156eSVernon Mauery std::unique_ptr<sdbusplus::bus::match_t> platStateIntfAddedMatch;
668b7c156eSVernon Mauery
678b7c156eSVernon Mauery static constexpr const char restrictionModeIntf[] =
688b7c156eSVernon Mauery "xyz.openbmc_project.Control.Security.RestrictionMode";
698b7c156eSVernon Mauery static constexpr const char* systemOsStatusIntf =
708b7c156eSVernon Mauery "xyz.openbmc_project.State.OperatingSystem.Status";
718b7c156eSVernon Mauery static constexpr const char* hostMiscIntf =
728b7c156eSVernon Mauery "xyz.openbmc_project.State.Host.Misc";
738b7c156eSVernon Mauery static constexpr const char* restrictionModePath =
748b7c156eSVernon Mauery "/xyz/openbmc_project/control/security/restriction_mode";
758b7c156eSVernon Mauery static constexpr const char* systemOsStatusPath =
76*4c042402SPotin Lai "/xyz/openbmc_project/state/host0";
778b7c156eSVernon Mauery };
788b7c156eSVernon Mauery
getSMMChannel()798b7c156eSVernon Mauery static inline uint8_t getSMMChannel()
808b7c156eSVernon Mauery {
818b7c156eSVernon Mauery ipmi::ChannelInfo chInfo;
828b7c156eSVernon Mauery
838b7c156eSVernon Mauery for (int channel = 0; channel < ipmi::maxIpmiChannels; channel++)
848b7c156eSVernon Mauery {
858b7c156eSVernon Mauery if (ipmi::getChannelInfo(channel, chInfo) != ipmi::ccSuccess)
868b7c156eSVernon Mauery {
878b7c156eSVernon Mauery continue;
888b7c156eSVernon Mauery }
898b7c156eSVernon Mauery
908b7c156eSVernon Mauery if (static_cast<ipmi::EChannelMediumType>(chInfo.mediumType) ==
918b7c156eSVernon Mauery ipmi::EChannelMediumType::systemInterface &&
928b7c156eSVernon Mauery channel != ipmi::channelSystemIface)
938b7c156eSVernon Mauery {
948b7c156eSVernon Mauery log<level::INFO>("SMM channel number",
958b7c156eSVernon Mauery entry("CHANNEL=%d", channel));
968b7c156eSVernon Mauery return channel;
978b7c156eSVernon Mauery }
988b7c156eSVernon Mauery }
998b7c156eSVernon Mauery log<level::ERR>("Unable to find SMM Channel Info");
1008b7c156eSVernon Mauery return -1;
1018b7c156eSVernon Mauery }
1028b7c156eSVernon Mauery
AllowlistFilter()1038b7c156eSVernon Mauery AllowlistFilter::AllowlistFilter()
1048b7c156eSVernon Mauery {
1058b7c156eSVernon Mauery bus = getSdBus();
1068b7c156eSVernon Mauery
1078b7c156eSVernon Mauery log<level::INFO>("Loading Allowlist filter");
1088b7c156eSVernon Mauery
1098b7c156eSVernon Mauery ipmi::registerFilter(ipmi::prioOpenBmcBase,
1108b7c156eSVernon Mauery [this](ipmi::message::Request::ptr request) {
1118b7c156eSVernon Mauery return filterMessage(request);
1128b7c156eSVernon Mauery });
1138b7c156eSVernon Mauery
1148b7c156eSVernon Mauery channelSMM = getSMMChannel();
1158b7c156eSVernon Mauery // wait until io->run is going to fetch RestrictionMode
1168b7c156eSVernon Mauery post_work([this]() { postInit(); });
1178b7c156eSVernon Mauery }
1188b7c156eSVernon Mauery
cacheRestrictedAndPostCompleteMode()1198b7c156eSVernon Mauery void AllowlistFilter::cacheRestrictedAndPostCompleteMode()
1208b7c156eSVernon Mauery {
1218b7c156eSVernon Mauery try
1228b7c156eSVernon Mauery {
123b37abfb2SPatrick Williams auto service = ipmi::getService(*bus, restrictionModeIntf,
124b37abfb2SPatrick Williams restrictionModePath);
1258b7c156eSVernon Mauery ipmi::Value v =
1268b7c156eSVernon Mauery ipmi::getDbusProperty(*bus, service, restrictionModePath,
1278b7c156eSVernon Mauery restrictionModeIntf, "RestrictionMode");
1288b7c156eSVernon Mauery auto& mode = std::get<std::string>(v);
1298b7c156eSVernon Mauery restrictionMode = RestrictionMode::convertModesFromString(mode);
1308b7c156eSVernon Mauery log<level::INFO>("Read restriction mode",
1318b7c156eSVernon Mauery entry("VALUE=%d", static_cast<int>(restrictionMode)));
1328b7c156eSVernon Mauery }
1338b7c156eSVernon Mauery catch (const std::exception&)
1348b7c156eSVernon Mauery {
1358b7c156eSVernon Mauery log<level::ERR>("Could not initialize provisioning mode, "
1368b7c156eSVernon Mauery "defaulting to restricted",
1378b7c156eSVernon Mauery entry("VALUE=%d", static_cast<int>(restrictionMode)));
1388b7c156eSVernon Mauery }
1398b7c156eSVernon Mauery
1408b7c156eSVernon Mauery try
1418b7c156eSVernon Mauery {
142b37abfb2SPatrick Williams auto service = ipmi::getService(*bus, systemOsStatusIntf,
143b37abfb2SPatrick Williams systemOsStatusPath);
144b37abfb2SPatrick Williams ipmi::Value v = ipmi::getDbusProperty(*bus, service, systemOsStatusPath,
145b37abfb2SPatrick Williams systemOsStatusIntf,
146b37abfb2SPatrick Williams "OperatingSystemState");
1478b7c156eSVernon Mauery auto& value = std::get<std::string>(v);
1488b7c156eSVernon Mauery updatePostComplete(value);
1498b7c156eSVernon Mauery log<level::INFO>("Read POST complete value",
1508b7c156eSVernon Mauery entry("VALUE=%d", postCompleted));
1518b7c156eSVernon Mauery }
1528b7c156eSVernon Mauery catch (const std::exception&)
1538b7c156eSVernon Mauery {
1548b7c156eSVernon Mauery log<level::ERR>("Error in OperatingSystemState Get");
1558b7c156eSVernon Mauery postCompleted = true;
1568b7c156eSVernon Mauery }
1578b7c156eSVernon Mauery }
1588b7c156eSVernon Mauery
updateRestrictionMode(const std::string & value)1598b7c156eSVernon Mauery void AllowlistFilter::updateRestrictionMode(const std::string& value)
1608b7c156eSVernon Mauery {
1618b7c156eSVernon Mauery restrictionMode = RestrictionMode::convertModesFromString(value);
1628b7c156eSVernon Mauery log<level::INFO>("Updated restriction mode",
1638b7c156eSVernon Mauery entry("VALUE=%d", static_cast<int>(restrictionMode)));
1648b7c156eSVernon Mauery }
1658b7c156eSVernon Mauery
handleRestrictedModeChange(sdbusplus::message_t & m)1668b7c156eSVernon Mauery void AllowlistFilter::handleRestrictedModeChange(sdbusplus::message_t& m)
1678b7c156eSVernon Mauery {
1688b7c156eSVernon Mauery std::string signal = m.get_member();
1698b7c156eSVernon Mauery if (signal == "PropertiesChanged")
1708b7c156eSVernon Mauery {
1718b7c156eSVernon Mauery std::string intf;
1728b7c156eSVernon Mauery std::vector<std::pair<std::string, ipmi::Value>> propertyList;
1738b7c156eSVernon Mauery m.read(intf, propertyList);
1748b7c156eSVernon Mauery for (const auto& property : propertyList)
1758b7c156eSVernon Mauery {
1768b7c156eSVernon Mauery if (property.first == "RestrictionMode")
1778b7c156eSVernon Mauery {
1788b7c156eSVernon Mauery updateRestrictionMode(std::get<std::string>(property.second));
1798b7c156eSVernon Mauery }
1808b7c156eSVernon Mauery }
1818b7c156eSVernon Mauery }
1828b7c156eSVernon Mauery else if (signal == "InterfacesAdded")
1838b7c156eSVernon Mauery {
1848b7c156eSVernon Mauery sdbusplus::message::object_path path;
1858b7c156eSVernon Mauery DbusInterfaceMap restModeObj;
1868b7c156eSVernon Mauery m.read(path, restModeObj);
1878b7c156eSVernon Mauery auto intfItr = restModeObj.find(restrictionModeIntf);
1888b7c156eSVernon Mauery if (intfItr == restModeObj.end())
1898b7c156eSVernon Mauery {
1908b7c156eSVernon Mauery return;
1918b7c156eSVernon Mauery }
1928b7c156eSVernon Mauery PropertyMap& propertyList = intfItr->second;
1938b7c156eSVernon Mauery auto itr = propertyList.find("RestrictionMode");
1948b7c156eSVernon Mauery if (itr == propertyList.end())
1958b7c156eSVernon Mauery {
1968b7c156eSVernon Mauery return;
1978b7c156eSVernon Mauery }
1988b7c156eSVernon Mauery updateRestrictionMode(std::get<std::string>(itr->second));
1998b7c156eSVernon Mauery }
2008b7c156eSVernon Mauery }
2018b7c156eSVernon Mauery
updatePostComplete(const std::string & value)2028b7c156eSVernon Mauery void AllowlistFilter::updatePostComplete(const std::string& value)
2038b7c156eSVernon Mauery {
2048b7c156eSVernon Mauery // The short string "Standby" is deprecated in favor of the full enum string
2058b7c156eSVernon Mauery // Support for the short string will be removed in the future.
2068b7c156eSVernon Mauery postCompleted = (value == "Standby") ||
2078b7c156eSVernon Mauery (value == "xyz.openbmc_project.State.OperatingSystem."
2088b7c156eSVernon Mauery "Status.OSStatus.Standby");
2098b7c156eSVernon Mauery log<level::INFO>(postCompleted ? "Updated to POST Complete"
2108b7c156eSVernon Mauery : "Updated to !POST Complete");
2118b7c156eSVernon Mauery }
2128b7c156eSVernon Mauery
handlePostCompleteChange(sdbusplus::message_t & m)2138b7c156eSVernon Mauery void AllowlistFilter::handlePostCompleteChange(sdbusplus::message_t& m)
2148b7c156eSVernon Mauery {
2158b7c156eSVernon Mauery std::string signal = m.get_member();
2168b7c156eSVernon Mauery if (signal == "PropertiesChanged")
2178b7c156eSVernon Mauery {
2188b7c156eSVernon Mauery std::string intf;
2198b7c156eSVernon Mauery std::vector<std::pair<std::string, ipmi::Value>> propertyList;
2208b7c156eSVernon Mauery m.read(intf, propertyList);
2218b7c156eSVernon Mauery for (const auto& property : propertyList)
2228b7c156eSVernon Mauery {
2238b7c156eSVernon Mauery if (property.first == "OperatingSystemState")
2248b7c156eSVernon Mauery {
2258b7c156eSVernon Mauery updatePostComplete(std::get<std::string>(property.second));
2268b7c156eSVernon Mauery }
2278b7c156eSVernon Mauery }
2288b7c156eSVernon Mauery }
2298b7c156eSVernon Mauery else if (signal == "InterfacesAdded")
2308b7c156eSVernon Mauery {
2318b7c156eSVernon Mauery sdbusplus::message::object_path path;
2328b7c156eSVernon Mauery DbusInterfaceMap postCompleteObj;
2338b7c156eSVernon Mauery m.read(path, postCompleteObj);
2348b7c156eSVernon Mauery auto intfItr = postCompleteObj.find(systemOsStatusIntf);
2358b7c156eSVernon Mauery if (intfItr == postCompleteObj.end())
2368b7c156eSVernon Mauery {
2378b7c156eSVernon Mauery return;
2388b7c156eSVernon Mauery }
2398b7c156eSVernon Mauery PropertyMap& propertyList = intfItr->second;
2408b7c156eSVernon Mauery auto itr = propertyList.find("OperatingSystemState");
2418b7c156eSVernon Mauery if (itr == propertyList.end())
2428b7c156eSVernon Mauery {
2438b7c156eSVernon Mauery return;
2448b7c156eSVernon Mauery }
2458b7c156eSVernon Mauery updatePostComplete(std::get<std::string>(itr->second));
2468b7c156eSVernon Mauery }
2478b7c156eSVernon Mauery }
2488b7c156eSVernon Mauery
cacheCoreBiosDone()2498b7c156eSVernon Mauery void AllowlistFilter::cacheCoreBiosDone()
2508b7c156eSVernon Mauery {
2518b7c156eSVernon Mauery std::string coreBiosDonePath;
2528b7c156eSVernon Mauery std::string coreBiosDoneService;
2538b7c156eSVernon Mauery try
2548b7c156eSVernon Mauery {
2558b7c156eSVernon Mauery ipmi::DbusObjectInfo coreBiosDoneObj =
2568b7c156eSVernon Mauery ipmi::getDbusObject(*bus, hostMiscIntf);
2578b7c156eSVernon Mauery
2588b7c156eSVernon Mauery coreBiosDonePath = coreBiosDoneObj.first;
2598b7c156eSVernon Mauery coreBiosDoneService = coreBiosDoneObj.second;
2608b7c156eSVernon Mauery }
2618b7c156eSVernon Mauery catch (const std::exception&)
2628b7c156eSVernon Mauery {
2638b7c156eSVernon Mauery log<level::ERR>("Could not initialize CoreBiosDone, "
2648b7c156eSVernon Mauery "coreBIOSDone asserted as default");
2658b7c156eSVernon Mauery return;
2668b7c156eSVernon Mauery }
2678b7c156eSVernon Mauery
2688b7c156eSVernon Mauery bus->async_method_call(
2698b7c156eSVernon Mauery [this](boost::system::error_code ec, const ipmi::Value& v) {
2708b7c156eSVernon Mauery if (ec)
2718b7c156eSVernon Mauery {
2728b7c156eSVernon Mauery log<level::ERR>(
2738b7c156eSVernon Mauery "async call failed, coreBIOSDone asserted as default");
2748b7c156eSVernon Mauery return;
2758b7c156eSVernon Mauery }
2768b7c156eSVernon Mauery coreBIOSDone = std::get<bool>(v);
2778b7c156eSVernon Mauery log<level::INFO>("Read CoreBiosDone",
2788b7c156eSVernon Mauery entry("VALUE=%d", static_cast<int>(coreBIOSDone)));
2798b7c156eSVernon Mauery },
2808b7c156eSVernon Mauery coreBiosDoneService, coreBiosDonePath,
2818b7c156eSVernon Mauery "org.freedesktop.DBus.Properties", "Get", hostMiscIntf, "CoreBiosDone");
2828b7c156eSVernon Mauery }
2838b7c156eSVernon Mauery
handleCoreBiosDoneChange(sdbusplus::message_t & msg)2848b7c156eSVernon Mauery void AllowlistFilter::handleCoreBiosDoneChange(sdbusplus::message_t& msg)
2858b7c156eSVernon Mauery {
2868b7c156eSVernon Mauery std::string signal = msg.get_member();
2878b7c156eSVernon Mauery if (signal == "PropertiesChanged")
2888b7c156eSVernon Mauery {
2898b7c156eSVernon Mauery std::string intf;
2908b7c156eSVernon Mauery std::vector<std::pair<std::string, ipmi::Value>> propertyList;
2918b7c156eSVernon Mauery msg.read(intf, propertyList);
2928b7c156eSVernon Mauery auto it =
2938b7c156eSVernon Mauery std::find_if(propertyList.begin(), propertyList.end(),
2948b7c156eSVernon Mauery [](const std::pair<std::string, ipmi::Value>& prop) {
2958b7c156eSVernon Mauery return prop.first == "CoreBiosDone";
2968b7c156eSVernon Mauery });
2978b7c156eSVernon Mauery
2988b7c156eSVernon Mauery if (it != propertyList.end())
2998b7c156eSVernon Mauery {
3008b7c156eSVernon Mauery coreBIOSDone = std::get<bool>(it->second);
3018b7c156eSVernon Mauery log<level::INFO>(coreBIOSDone ? "coreBIOSDone asserted"
3028b7c156eSVernon Mauery : "coreBIOSDone not asserted");
3038b7c156eSVernon Mauery }
3048b7c156eSVernon Mauery }
3058b7c156eSVernon Mauery else if (signal == "InterfacesAdded")
3068b7c156eSVernon Mauery {
3078b7c156eSVernon Mauery sdbusplus::message::object_path path;
3088b7c156eSVernon Mauery DbusInterfaceMap eSpiresetObj;
3098b7c156eSVernon Mauery msg.read(path, eSpiresetObj);
3108b7c156eSVernon Mauery auto intfItr = eSpiresetObj.find(hostMiscIntf);
3118b7c156eSVernon Mauery if (intfItr == eSpiresetObj.end())
3128b7c156eSVernon Mauery {
3138b7c156eSVernon Mauery return;
3148b7c156eSVernon Mauery }
3158b7c156eSVernon Mauery PropertyMap& propertyList = intfItr->second;
3168b7c156eSVernon Mauery auto itr = propertyList.find("CoreBiosDone");
3178b7c156eSVernon Mauery if (itr == propertyList.end())
3188b7c156eSVernon Mauery {
3198b7c156eSVernon Mauery return;
3208b7c156eSVernon Mauery }
3218b7c156eSVernon Mauery coreBIOSDone = std::get<bool>(itr->second);
3228b7c156eSVernon Mauery log<level::INFO>(coreBIOSDone ? "coreBIOSDone asserted"
3238b7c156eSVernon Mauery : "coreBIOSDone not asserted");
3248b7c156eSVernon Mauery }
3258b7c156eSVernon Mauery }
3268b7c156eSVernon Mauery
postInit()3278b7c156eSVernon Mauery void AllowlistFilter::postInit()
3288b7c156eSVernon Mauery {
3298b7c156eSVernon Mauery // Wait for changes on Restricted mode
3308b7c156eSVernon Mauery namespace rules = sdbusplus::bus::match::rules;
3318b7c156eSVernon Mauery const std::string filterStrModeChange =
3328b7c156eSVernon Mauery rules::type::signal() + rules::member("PropertiesChanged") +
3338b7c156eSVernon Mauery rules::interface("org.freedesktop.DBus.Properties") +
3348b7c156eSVernon Mauery rules::argN(0, restrictionModeIntf);
3358b7c156eSVernon Mauery
3368b7c156eSVernon Mauery const std::string filterStrModeIntfAdd =
3378b7c156eSVernon Mauery rules::interfacesAdded() +
3388b7c156eSVernon Mauery rules::argNpath(
3398b7c156eSVernon Mauery 0, "/xyz/openbmc_project/control/security/restriction_mode");
3408b7c156eSVernon Mauery
3418b7c156eSVernon Mauery const std::string filterStrPostComplete =
3428b7c156eSVernon Mauery rules::type::signal() + rules::member("PropertiesChanged") +
3438b7c156eSVernon Mauery rules::interface("org.freedesktop.DBus.Properties") +
3448b7c156eSVernon Mauery rules::argN(0, systemOsStatusIntf);
3458b7c156eSVernon Mauery
3468b7c156eSVernon Mauery const std::string filterStrPostIntfAdd =
3478b7c156eSVernon Mauery rules::interfacesAdded() +
348*4c042402SPotin Lai rules::argNpath(0, "/xyz/openbmc_project/state/host0");
3498b7c156eSVernon Mauery
3508b7c156eSVernon Mauery const std::string filterStrPlatStateChange =
3518b7c156eSVernon Mauery rules::type::signal() + rules::member("PropertiesChanged") +
3528b7c156eSVernon Mauery rules::interface("org.freedesktop.DBus.Properties") +
3538b7c156eSVernon Mauery rules::argN(0, hostMiscIntf);
3548b7c156eSVernon Mauery
3558b7c156eSVernon Mauery const std::string filterStrPlatStateIntfAdd =
3568b7c156eSVernon Mauery rules::interfacesAdded() +
3578b7c156eSVernon Mauery rules::argNpath(0, "/xyz/openbmc_project/misc/platform_state");
3588b7c156eSVernon Mauery
3598b7c156eSVernon Mauery modeChangeMatch = std::make_unique<sdbusplus::bus::match_t>(
3608b7c156eSVernon Mauery *bus, filterStrModeChange,
3618b7c156eSVernon Mauery [this](sdbusplus::message_t& m) { handleRestrictedModeChange(m); });
3628b7c156eSVernon Mauery modeIntfAddedMatch = std::make_unique<sdbusplus::bus::match_t>(
3638b7c156eSVernon Mauery *bus, filterStrModeIntfAdd,
3648b7c156eSVernon Mauery [this](sdbusplus::message_t& m) { handleRestrictedModeChange(m); });
3658b7c156eSVernon Mauery
3668b7c156eSVernon Mauery postCompleteMatch = std::make_unique<sdbusplus::bus::match_t>(
3678b7c156eSVernon Mauery *bus, filterStrPostComplete,
3688b7c156eSVernon Mauery [this](sdbusplus::message_t& m) { handlePostCompleteChange(m); });
3698b7c156eSVernon Mauery
3708b7c156eSVernon Mauery postCompleteIntfAddedMatch = std::make_unique<sdbusplus::bus::match_t>(
3718b7c156eSVernon Mauery *bus, filterStrPostIntfAdd,
3728b7c156eSVernon Mauery [this](sdbusplus::message_t& m) { handlePostCompleteChange(m); });
3738b7c156eSVernon Mauery
3748b7c156eSVernon Mauery platStateChangeMatch = std::make_unique<sdbusplus::bus::match_t>(
3758b7c156eSVernon Mauery *bus, filterStrPlatStateChange,
3768b7c156eSVernon Mauery [this](sdbusplus::message_t& m) { handleCoreBiosDoneChange(m); });
3778b7c156eSVernon Mauery
3788b7c156eSVernon Mauery platStateIntfAddedMatch = std::make_unique<sdbusplus::bus::match_t>(
3798b7c156eSVernon Mauery *bus, filterStrPlatStateIntfAdd,
3808b7c156eSVernon Mauery [this](sdbusplus::message_t& m) { handleCoreBiosDoneChange(m); });
3818b7c156eSVernon Mauery
3828b7c156eSVernon Mauery // Initialize restricted mode
3838b7c156eSVernon Mauery cacheRestrictedAndPostCompleteMode();
3848b7c156eSVernon Mauery // Initialize CoreBiosDone
3858b7c156eSVernon Mauery cacheCoreBiosDone();
3868b7c156eSVernon Mauery }
3878b7c156eSVernon Mauery
filterMessage(ipmi::message::Request::ptr request)3888b7c156eSVernon Mauery ipmi::Cc AllowlistFilter::filterMessage(ipmi::message::Request::ptr request)
3898b7c156eSVernon Mauery {
3908b7c156eSVernon Mauery auto channelMask = static_cast<unsigned short>(1 << request->ctx->channel);
3918b7c156eSVernon Mauery bool Allowlisted = std::binary_search(
3928b7c156eSVernon Mauery allowlist.cbegin(), allowlist.cend(),
3938b7c156eSVernon Mauery std::make_tuple(request->ctx->netFn, request->ctx->cmd, channelMask),
3948b7c156eSVernon Mauery [](const netfncmd_tuple& first, const netfncmd_tuple& value) {
3958b7c156eSVernon Mauery return (std::get<2>(first) & std::get<2>(value))
3968b7c156eSVernon Mauery ? first < std::make_tuple(std::get<0>(value),
3978b7c156eSVernon Mauery std::get<1>(value),
3988b7c156eSVernon Mauery std::get<2>(first))
3998b7c156eSVernon Mauery : first < value;
4008b7c156eSVernon Mauery });
4018b7c156eSVernon Mauery
4028b7c156eSVernon Mauery // no special handling for non-system-interface channels
4038b7c156eSVernon Mauery if (!(request->ctx->channel == ipmi::channelSystemIface ||
4048b7c156eSVernon Mauery request->ctx->channel == channelSMM))
4058b7c156eSVernon Mauery {
4068b7c156eSVernon Mauery if (!Allowlisted)
4078b7c156eSVernon Mauery {
4088b7c156eSVernon Mauery log<level::INFO>("Channel/NetFn/Cmd not Allowlisted",
4098b7c156eSVernon Mauery entry("CHANNEL=0x%X", request->ctx->channel),
4108b7c156eSVernon Mauery entry("NETFN=0x%X", int(request->ctx->netFn)),
4118b7c156eSVernon Mauery entry("CMD=0x%X", int(request->ctx->cmd)));
4128b7c156eSVernon Mauery return ipmi::ccInsufficientPrivilege;
4138b7c156eSVernon Mauery }
4148b7c156eSVernon Mauery return ipmi::ccSuccess;
4158b7c156eSVernon Mauery }
4168b7c156eSVernon Mauery
4178b7c156eSVernon Mauery // for system interface, filtering is done as follows:
4188b7c156eSVernon Mauery // Allow All: preboot ? ccSuccess : ccSuccess
4198b7c156eSVernon Mauery // Restricted: preboot ? ccSuccess :
4208b7c156eSVernon Mauery // ( Allowlist ? ccSuccess : ccInsufficientPrivilege )
4218b7c156eSVernon Mauery // Deny All: preboot ? ccSuccess : ccInsufficientPrivilege
4228b7c156eSVernon Mauery
4238b7c156eSVernon Mauery if (!(postCompleted || coreBIOSDone))
4248b7c156eSVernon Mauery {
4258b7c156eSVernon Mauery // Allow all commands, till POST or CoreBiosDone is completed
4268b7c156eSVernon Mauery return ipmi::ccSuccess;
4278b7c156eSVernon Mauery }
4288b7c156eSVernon Mauery
4298b7c156eSVernon Mauery switch (restrictionMode)
4308b7c156eSVernon Mauery {
4318b7c156eSVernon Mauery case RestrictionMode::Modes::None:
4328b7c156eSVernon Mauery case restrictionModeAllowAll:
4338b7c156eSVernon Mauery {
4348b7c156eSVernon Mauery // Allow All
4358b7c156eSVernon Mauery return ipmi::ccSuccess;
4368b7c156eSVernon Mauery break;
4378b7c156eSVernon Mauery }
4388b7c156eSVernon Mauery case restrictionModeRestricted:
4398b7c156eSVernon Mauery {
4408b7c156eSVernon Mauery // Restricted - follow Allowlist
4418b7c156eSVernon Mauery break;
4428b7c156eSVernon Mauery }
4438b7c156eSVernon Mauery case restrictionModeDenyAll:
4448b7c156eSVernon Mauery {
4458b7c156eSVernon Mauery // Deny All
4468b7c156eSVernon Mauery Allowlisted = false;
4478b7c156eSVernon Mauery break;
4488b7c156eSVernon Mauery }
44980d4d5f9SMatt Simmering default: // for Allowlist and Blocklist
4508b7c156eSVernon Mauery return ipmi::ccInsufficientPrivilege;
4518b7c156eSVernon Mauery }
4528b7c156eSVernon Mauery
4538b7c156eSVernon Mauery if (!Allowlisted)
4548b7c156eSVernon Mauery {
4558b7c156eSVernon Mauery log<level::INFO>("Channel/NetFn/Cmd not allowlisted",
4568b7c156eSVernon Mauery entry("CHANNEL=0x%X", request->ctx->channel),
4578b7c156eSVernon Mauery entry("NETFN=0x%X", int(request->ctx->netFn)),
4588b7c156eSVernon Mauery entry("CMD=0x%X", int(request->ctx->cmd)));
4598b7c156eSVernon Mauery return ipmi::ccInsufficientPrivilege;
4608b7c156eSVernon Mauery }
4618b7c156eSVernon Mauery return ipmi::ccSuccess;
4628b7c156eSVernon Mauery } // namespace
4638b7c156eSVernon Mauery
4648b7c156eSVernon Mauery // instantiate the AllowlistFilter when this shared object is loaded
4658b7c156eSVernon Mauery AllowlistFilter allowlistFilter;
4668b7c156eSVernon Mauery
4678b7c156eSVernon Mauery } // namespace
4688b7c156eSVernon Mauery
4698b7c156eSVernon Mauery } // namespace ipmi
470