BMC/OpenBmc/bmcweb.git/include, branch master

include,http: Extract getUserInfo/onRequestRecv

2026-09-19T14:52:07+00:00

Move long lambdas in getUserInfo() and onRequestRecv() into named functions, afterGetUserInfo() and afterCompleteRequest(), per the <10 line lambda rule in docs/COMMON_ERRORS.md. No functional change. Tested: - Tested on AST2600 SoC. - getUserInfo/afterGetUserInfo: sent an authenticated Basic-auth Redfish GET and confirmed a 200 response with no "Failed to populate user information" error in journalctl, proving populateUserInfo() succeeded via the extracted callback. - onRequestRecv/afterCompleteRequest: RSV's client uses HTTP/1.1, so it does not exercise this HTTP/2-only code path. Instead, used "curl --http2" and confirmed ALPN negotiated h2 and the request completed as HTTP/2 200. journalctl -u bmcweb confirmed both "onRequestRecv streamId:1" and the extracted callback's "res.completeRequestHandler called" fired for that stream. - Redfish Service Validator: 5830 Pass / 353 Warn / 0 Fail. Change-Id: I0e6365c682f6acc8d39510ad5f1fe239d747154f Signed-off-by: Yuvakumar Selvamani

Detect HTML content type with existing parser

2026-07-16T17:21:50+00:00

Use http_helpers::getContentType() when deciding whether to add HTML-only security headers. Previously this logic checked the raw Content-Type header with a text/html prefix match. That worked for the values we emit today, but it open-coded Content-Type handling in this path instead of using the existing parser. Switch this logic to getContentType() so it stays consistent with the rest of the code and correctly handles valid variations such as case-insensitive HTML MIME types. Add unit coverage for getContentType() to verify HTML MIME types with charset parameters and case-insensitive input. Tested: unit tests passed. Change-Id: I1cff40453ab4851cc7b24615a20fb6abcfba864b Signed-off-by: Joel Pullokaran Jesin

Fix bug in asio resolver

2026-07-15T18:27:05+00:00

This regressed when the bypass was added. Fix the code for resolver=asio to properly construct the results object using the built in asio type instead of std::vector. Tested: Code compiles with resolver=asio again. Change-Id: I3d9ddc38b88a392cf82fc81bd5609f3360837393 Signed-off-by: Ed Tanous

Allow setting Mozilla modern

2026-07-02T18:30:22+00:00

Mozilla publishes recommendations for TLS cipher suites to support. For many years bmcweb selected "intermediate" because of compatibility with clients that didn't yet support TLS1.3. This commit adds the ability to use the Mozilla modern recommendations, and disable TLS1.2 support through a new meson option, tls-profile. Tested: Loaded on qemu, and verified with testssl.sh[1] that parameters were applied. [1] https://github.com/testssl/testssl.sh Change-Id: I38e915b3943b5dbe5fb31e54eb3ebda9bbaeb811 Signed-off-by: Ed Tanous

Flag long lambdas

2026-07-01T17:10:08+00:00

Long lambdas have been documented as an anti-pattern for some time.[1] Despite this being generally understood, bmcweb has a long ways to go cleaning these up, and routinely code is submitted in violation of this anti-pattern. Invent an ast-grep rule that can identify when new examples of this anti-pattern are added, and ignore the existing 200+ examples that are in the codebase already using ast-grep ignore. These flags will give us something to search for as we clean this up, and will help to prevent new instances from being added unintentionally. [1] https://github.com/openbmc/docs/blob/master/anti-patterns.md#very-long-lambda-callbacks Tested: Comment only change. ast-grep passes. Manually removing an ast-grep ignore flag shows as a failure in ast-grep scan Change-Id: I77d634a393884969f184d2c39c02cc08288d5a29 Signed-off-by: Ed Tanous

sdbusplus: use shorter type aliases

2026-06-19T11:42:03+00:00

The sdbusplus headers provide shortened aliases for many types. Switch to using them to provide better code clarity and shorter lines. Possible replacements are for: * exception_t * manager_t * match * match_rules * message_t * object_t * slot_t Change-Id: Iaf2a83fb67d57a6fafb664d27b349add17a96bcd Signed-off-by: Patrick Williams

Generate 64 bit serial numbers

2026-06-12T16:01:54+00:00

Even though the certificate is self signed, we should pass as many certificate tests as possible. testssl.sh prints ``` Serial 4B32D4F0 NOT ok: length should be >= 64 bits entropy (is: 4 bytes) ``` On our default certificate. This is relatively easy to fix. Change-Id: Ib1eb07b637ebf49ecf954b3d98ced9e9ef0f5a34 Signed-off-by: Ed Tanous

OpenSSL cleanup

2026-06-12T16:01:54+00:00

Continue moving OpenSSL into reusable RAII classes that can be used in unit tests and other places. This is slightly more code, but as we're adding unit tests, it allows reuse between unit tests rather than writing C directly. It also encapsulates the complexity of parsing openssl output (usually in bytes) into standard types (string) that can be compared/modified. Functionally this adds two new classes to the "wrappers" functions, OpenSSLSSLCtx and OpenSSLSSL, which each wrap SSL_CTX and SSL objects respectively from openssl. These are rough approximations of the boost equivalents. Change-Id: Id87ac4ccde88890bd70861deffdb256188ec0e39 Signed-off-by: Ed Tanous

sdbusplus: use shorter type aliases

2026-06-09T09:31:20+00:00

The sdbusplus headers provide shortened aliases for many types. Switch to using them to provide better code clarity and shorter lines. Possible replacements are for: * bus_t * exception_t * manager_t * match_t * message_t * object_t * slot_t * object_path Change-Id: I05ee2b2cda7c4468ab4117c751ecee797121b7dd Signed-off-by: Patrick Williams

account_service: invalidate sessions when account is disabled

2026-06-08T15:23:04+00:00

PATCH /redfish/v1/AccountService/Accounts/ with {"Enabled":false} flipped UserEnabled on D-Bus but left every active X-Auth-Token session for that user fully usable. Subsequent token-authenticated requests continued to succeed (200 OK) until the token's natural expiry, even though Basic auth for the same account was correctly rejected (401). DELETE on the same resource does not have this problem because removing the user object emits InterfacesRemoved, and bmcweb::onUserRemoved (in include/user_monitor.hpp) handles that signal by calling removeSessionsByUsername. Add onUserPropertiesChanged() in include/user_monitor.hpp that drops the user's sessions via SessionStore::removeSessionsByUsername() when User.Attributes.UserEnabled transitions to false. This handles disable of user both from IPMI and Redfish Tested : ``` Create new user curl -k -u ${USER}:${PASSWD} -X POST https://127.0.0.1:2443/redfish/v1/AccountService/Accounts -d '{ UserName:test_admin, Password:Shahapur#13!Shahapur, RoleId:Administrator, Enabled:true}' { "@Message.ExtendedInfo": [ { "@odata.type": "#Message.v1_1_1.Message", "Message": "The resource was created successfully.", "MessageArgs": [], "MessageId": "Base.1.19.Created", "MessageSeverity": "OK", "Resolution": "None." } ] } Create a-auth-token curl --insecure -X POST -D headers.txt https://127.0.0.1:2443/redfish/v1/SessionService/Sessions -d '{"UserName":"test_admin", "Password":"Shahapur#13!Shahapur"}' { "@odata.id": "/redfish/v1/SessionService/Sessions/YLMzEtANWr", "@odata.type": "#Session.v1_7_0.Session", "ClientOriginIPAddress": "10.0.2.2", "Description": "Manager User Session", "Id": "YLMzEtANWr", "Name": "User Session", "Roles": [ "Administrator" ], "UserName": "test_admin" } $ cat headers.txt HTTP/2 201 allow: GET, HEAD, POST odata-version: 4.0 x-auth-token: VcufgTshiDjEn8HbGh31 location: /redfish/v1/SessionService/Sessions/YLMzEtANWr strict-transport-security: max-age=31536000; includeSubdomains pragma: no-cache cache-control: no-store, max-age=0 x-content-type-options: nosniff content-type: application/json date: Wed, 06 May 2026 12:45:18 GMT content-length: 305 // Test RF request with token curl -k -H 'x-auth-token:VcufgTshiDjEn8HbGh31' https://127.0.0.1:2443/redfish/v1/AccountService/Accounts { "@odata.id": "/redfish/v1/AccountService/Accounts", "@odata.type": "#ManagerAccountCollection.ManagerAccountCollection", "Description": "BMC User Accounts", "Members": [ { "@odata.id": "/redfish/v1/AccountService/Accounts/test_admin" }, { "@odata.id": "/redfish/v1/AccountService/Accounts/root" } ], "Members@odata.count": 2, "Name": "Accounts Collection" } // Disable the user curl -k -u root:0penBmc https://127.0.0.1:2443/redfish/v1/AccountService/Accounts/test_admin -X PATCH -d '{"Enabled":false}' 204 // Try to use the Tokens curl -k -H 'x-auth-token:VcufgTshiDjEn8HbGh31' https://127.0.0.1:2443/redfish/v1/AccountService/Accounts 401 ``` Change-Id: I3246d3f5ec7db405c9c186a8672a9fed18259249 Signed-off-by: Chandramohan Harkude