BMC/OpenBmc/bmcweb.git/test/http, branch master

Add Fuzz target

2026-07-24T17:31:51+00:00

Recently, oss-fuzz added support for bmcweb, but did it by checking in a number of code patches. This commit should get similar coverage by hooking into the HTTP connection class, and using the unit test code to inject bytes directly into a stream. This can be improved over time, but this is a good start. Change-Id: I20b5d536cff1588a8387f2770c022516e1cd62d0 Signed-off-by: Ed Tanous

Remove final IWYU hints

2026-07-24T17:21:42+00:00

IWYU is not a tool we have seen results from in some time. I very much suspect that these few comments are not enough to get a clean build. Clean them up. If we want to turn this tool back on in the future, this patch can be reverted. Tested: Comment only change. Review only. Change-Id: I45ff737800f9d8b1b63db2f482e59f815d7126a2 Signed-off-by: Ed Tanous

Implement Response header count

2026-07-22T18:29:44+00:00

Add Response::headerCount() to return the total number of stored header fields on a response. The implementation counts the current header entries directly from the underlying Beast header container. Added unit coverage to verify the method reports the full header count after headers are added through the normal addHeader() path. Tested with: meson test -C build http_response_test --print-errorlogs This helper is used by response unit tests to verify that only the expected headers are present and that no unexpected headers are added to the response. See also: https://gerrit.openbmc.org/c/openbmc/bmcweb/+/91848 Change-Id: I28432bb4fc982db44cee0688395d04ac513d6749 Signed-off-by: Joel Pullokaran Jesin

Updating maxValues to support roughly 200 bmcweb sessions

2026-07-09T19:21:12+00:00

parseStringAsJson() routes through BmcwebSaxParse, which hard-caps a payload at 500 total JSON values to defend against malicious external HTTP request bodies. The most visible symptom is that bmcweb silently loses every persisted session across a restart once ~50 sessions accumulate (each persisted session is ~11 JSON values, so the file trips the cap and is treated as malformed). Tntegration testing hit this 50 session limit and failed. (Was failing our internal but also the openbmc-test-automation robot suite) I had originally implemented a solution as a "trusted reader" with no limit ( https://gerrit.openbmc.org/c/openbmc/bmcweb/+/90138 ); however, the security implications of "no limit" weren't attractive. This area may be refactored in the near future to represent each session as a distinct json file. This value bump gets us past the immediate needs without introducing a lot of churn in code that will be refactored. Change-Id: Ifd3514bd8ee15c8bdf1b6c2119451a2965801671 Signed-off-by: Rick Yazwinski

http2: pass client IP address to HTTP/2 requests

2026-06-15T23:55:11+00:00

HTTP/2 connections were not passing the resolved client IP into the per-request ipAddress field, causing sessions to report 0.0.0.0 instead of the actual client address. Additionally, authentication::authenticate() was called with an empty IP, resulting in Basic Auth sessions being created with an incorrect clientIp in the session store. Pass the IP through the HTTP2Connection constructor, use it in the authenticate() call, and assign it to req->ipAddress during request dispatch in onRequestRecv. Tested: - Client IP correctly displayed in Redfish SessionService on HTTP/2 connections. - Before patch: ClientOriginIPAddress showed "0.0.0.0" - After patch: ClientOriginIPAddress shows actual client IP - Redfish Service Validator (v3.1.4) passed on /redfish/v1/SessionService tree: PASS: 44, WARN: 0, FAIL: 0, NOT TESTED: 41 Before: curl -k https://127.0.0.1:2443/redfish/v1/\ SessionService/Sessions/O9gUpSoxbe -u root:0penBmc { "@odata.id": "/redfish/v1/SessionService/Sessions/O9gUpSoxbe", "@odata.type": "#Session.v1_7_0.Session", "ClientOriginIPAddress": "0.0.0.0", "Description": "Manager User Session", "Id": "O9gUpSoxbe", "Name": "User Session", "Roles": [ "Administrator" ], "UserName": "root" } After this patch: curl -k https://172.31.216.225/redfish/v1/\ SessionService/Sessions/LuttjprSGD -u root:0penBmc { "@odata.id": "/redfish/v1/SessionService/Sessions/LuttjprSGD", "@odata.type": "#Session.v1_7_0.Session", "ClientOriginIPAddress": "10.0.136.165", "Description": "Manager User Session", "Id": "LuttjprSGD", "Name": "User Session", "Roles": [ "Administrator" ], "UserName": "root" } Change-Id: I223e5c90448419ba87b690de38cc5e69ffb6a0c3 Signed-off-by: Vijaysankar Ravi

OpenSSL cleanup

2026-06-12T16:01:54+00:00

Continue moving OpenSSL into reusable RAII classes that can be used in unit tests and other places. This is slightly more code, but as we're adding unit tests, it allows reuse between unit tests rather than writing C directly. It also encapsulates the complexity of parsing openssl output (usually in bytes) into standard types (string) that can be compared/modified. Functionally this adds two new classes to the "wrappers" functions, OpenSSLSSLCtx and OpenSSLSSL, which each wrap SSL_CTX and SSL objects respectively from openssl. These are rough approximations of the boost equivalents. Change-Id: Id87ac4ccde88890bd70861deffdb256188ec0e39 Signed-off-by: Ed Tanous

http: zstd: do not attempt compressing already opened files

2026-06-01T22:28:11+00:00

Commit 2d7dc991 changed the body storage from being saved in a separate field to a std::variant. Calling str() calls emplace(), which destroys the active FileBody in-place on file-backed bodies (e.g. the Web UI) and closes the FD. Any subsequent action now tries to access a non-existing FD (dummy handle returning -1 as FD.) Fix by returning early from `attemptZstdCompression` when the body is file-backed, as file-backed bodies are already handled by the streaming zstdCompressor in the writer. Tested: cURL with "Accept-Encoding: zstd" to favicon.ico, ensuring that it returns data again. Fixes: 2d7dc991 ("Optimize bmcweb memory usage for multipart fw update") Change-Id: Ia54712f89d8c5f7dc9ce7c5d040aed06e8f6fded Signed-off-by: Tan Siewert

Remove unneeded test

2026-05-17T18:02:09+00:00

After RAII change code accepts UTF8 only, so the code doesn't use non-UTF8. This test uses ASCII that is UTF8 and duplicates other tests, so remove NonUTF8UPNSubjectAlternativeName test. Tested: Unit tests Change-Id: I48b8f0cbf644abce99a864e9dccd23f308693908 Signed-off-by: Igor Kanyuka

Fix bad merge resolution

2026-05-13T17:51:06+00:00

There was a regression on json parsing due to a merge conflict resolution on 2d7dc991600297d04e50d7958fe9611f9ac42bcf. Update the connection unit tests to test the body catching this case, and fix the error. Tested: Unit tests pass. Redfish service validator passes Change-Id: I4ad8802b7c75001ca7a2b1619af2f368bfe448ee Signed-off-by: Ed Tanous Signed-off-by: Gunnar Mills

Add more unit tests for UPN functionality

2026-04-27T18:51:54+00:00

Current unit tests only covers happy path. Add more unit tests before changing the code. Tested: unit tests Change-Id: Ibba5dbbc1457b59670d5d8f3c828fa9ca112f88c Signed-off-by: Igor Kanyuka