summaryrefslogtreecommitdiff
path: root/http
AgeCommit message (Collapse)AuthorFilesLines
2023-08-07Fix bugprone-unchecked-optional-access findingsEd Tanous4-35/+59
Clang-tidy has the aforementioned check, which shows a few places in the core where we ignored the required optional checks. Fix all uses. Note, we cannot enable the check that this time because of some weird code in health.hpp that crashes tidy[1]. That will need to be a future improvement. There are tests that call something like ASSERT(optional) EXPECT(optional->foo()) While this isn't an actual violation, clang-tidy doesn't seem to be smart enough to deal with it, so add some explicit checks. [1] https://github.com/llvm/llvm-project/issues/55530 Tested: Redfish service validator passes. Change-Id: Ied579cd0b957efc81aff5d5d1091a740a7a2d7e3 Signed-off-by: Ed Tanous <edtanous@google.com>
2023-08-02Fix logging level handlingMyung Bae1-1/+1
The log entries with the meson configured log level are currently missing. Tested: - Add the logging level to debug to local.conf ``` conf/local.conf: EXTRA_OEMESON:pn-bmcweb:append = "-Dbmcweb-logging='debug'" ``` - Run the current bmcweb and check bmcweb DEBUG logs which won't be shown. - With the fix, do the same test and check the DEBUG logs. ``` Aug 02 00:07:52 p10bmc bmcweb[229]: [INFO http_connection.hpp:229] Request: 0x1759d10 HTTP/1.1 GET /redfish ::ffff:127.0.0.1 Aug 02 00:07:52 p10bmc bmcweb[229]: [DEBUG http_connection.hpp:260] Setting completion handler Aug 02 00:07:52 p10bmc bmcweb[229]: [DEBUG http_response.hpp:238] 0x16d2540 setting completion handler Aug 02 00:07:52 p10bmc bmcweb[229]: [DEBUG routing.hpp:669] Matched rule '/redfish/' 1 / 2 Aug 02 00:07:52 p10bmc bmcweb[229]: [DEBUG query.hpp:121] setup redfish route ``` Similar tests can be done with the other logging level. Change-Id: Ifd6dac5b734363fbad70bc62f3dd03a5053ed2fd Signed-off-by: Myung Bae <myungbae@us.ibm.com>
2023-08-01Revert "Cache user role in session object"Gunnar Mills1-0/+1
This reverts commit 8ed41c35a314580bb794fa0fff2e01b0bf7efcf7. In discord, it was posted 2 systems are hitting 403 Forbidden for all endpoints. Reverting fixed the problem, until time is given to dive into this, just revert. One of the things wrong is this is missing an After/Want xyz.openbmc_project.User.Manager.service. Change-Id: I1766a6ec2dbc9fb52da3940b07ac002a1a6d269a Signed-off-by: Gunnar Mills <gmills@us.ibm.com>
2023-07-28Cache user role in session objectEd Tanous1-1/+0
There is an async call within the router that leads to a small, but pervasive performance issue for all queries. Removing that call from the router has the potential to increase the performance of every authenticated query, and significantly reduce our dbus traffic for "simple" operations. This commit re-implements the role cache in session object that existed previously many years ago. Each users role is fetched during authentication and persisted in session object. Each successive request can then be matched against the privilege which is there in the in-memory session object. This was discussed on below commit https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/39756 Tested by: ``` POST /redfish/v1/SessionService/Sessions {"UserName":"root", "Password": “0penBmc”} ``` Followed by redfish queries Get /redfish/v1/AccountService Tested user role persistency Redfish service validator passes. Signed-off-by: Ravi Teja <raviteja28031990@gmail.com> Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: I575599c29358e32849446ce6ee7f62c8eb3885f6
2023-07-27Fix loggingEd Tanous1-27/+15
The recent change to logging has caused a couple of bugs. First, when building within yocto, the complete path is now returned on log messages. This is wasteful of speed, and not super helpful to developers to have a full path. Per the discussion on the original patchset, drop this down to just the filename. 2, because of it's use as a pseudo log level, "enabled" is in the list of strings. This causes an index mismatch, which causes logs to be logged at the wrong level beyond debug. Move the entry to the end to fix this. Third, move the logging of level to upper case, to follow the old convention. Tested: Enabled meson option for logging, observed logs like: ``` Jul 25 18:39:20 qemux86-64 bmcweb[209]: [DEBUG query.hpp:121] setup redfish route Jul 25 18:39:20 qemux86-64 bmcweb[209]: [DEBUG http_response.hpp:248] 0x561bc11a7a40 releasing ce Jul 25 18:39:20 qemux86-64 bmcweb[209]: [DEBUG http_response.hpp:238] 0x561bc11a7a40 setting comr Jul 25 18:39:20 qemux86-64 bmcweb[209]: [DEBUG http_response.hpp:223] 0x561bc11a7a40 calling comr Jul 25 18:39:20 qemux86-64 bmcweb[209]: [DEBUG http_response.hpp:226] 0x561bc11a7a40 completion d Jul 25 18:39:20 qemux86-64 bmcweb[209]: [DEBUG query_param.hpp:1019] Processing query params ``` Change-Id: I4ac506c623a17f81ae83545e59291d2729dc82cb Signed-off-by: Ed Tanous <edtanous@google.com>
2023-07-25Fix events destination url parsing for IPv6Ravi Teja1-1/+1
Currently while parsing destination URL, host address enclosed in [] braces for IPv6 addresses, so Resolve hostname fails for IPv6 addresses because of this invalid hostname which is enclosed in [] braces. This commit uses encoded_host_address() method to fix this parsing hostname for IPv6 address. Tested By: Configured redfish event subscription with IPv6 destination URI verified parsing logic of destination URI with IPv6 addresses. Change-Id: I0e43468086ae0b961eb724de30e211d61ccda2d8 Signed-off-by: Ravi Teja <raviteja28031990@gmail.com>
2023-07-20Replace logging with std::formatEd Tanous15-391/+470
std::format is a much more modern logging solution, and gives us a lot more flexibility, and better compile times when doing logging. Unfortunately, given its level of compile time checks, it needs to be a method, instead of the stream style logging we had before. This requires a pretty substantial change. Fortunately, this change can be largely automated, via the script included in this commit under scripts/replace_logs.py. This is to aid people in moving their patchsets over to the new form in the short period where old patches will be based on the old logging. The intention is that this script eventually goes away. The old style logging (stream based) looked like. BMCWEB_LOG_DEBUG << "Foo " << foo; The new equivalent of the above would be: BMCWEB_LOG_DEBUG("Foo {}", foo); In the course of doing this, this also cleans up several ignored linter errors, including macro usage, and array to pointer deconstruction. Note, This patchset does remove the timestamp from the log message. In practice, this was duplicated between journald and bmcweb, and there's no need for both to exist. One design decision of note is the addition of logPtr. Because the compiler can't disambiguate between const char* and const MyThing*, it's necessary to add an explicit cast to void*. This is identical to how fmt handled it. Tested: compiled with logging meson_option enabled, and launched bmcweb Saw the usual logging, similar to what was present before: ``` [Error include/webassets.hpp:60] Unable to find or open /usr/share/www/ static file hosting disabled [Debug include/persistent_data.hpp:133] Restored Session Timeout: 1800 [Debug redfish-core/include/event_service_manager.hpp:671] Old eventService config not exist [Info src/webserver_main.cpp:59] Starting webserver on port 18080 [Error redfish-core/include/event_service_manager.hpp:1301] inotify_add_watch failed for redfish log file. [Info src/webserver_main.cpp:137] Start Hostname Monitor Service... ``` Signed-off-by: Ed Tanous <ed@tanous.net> Change-Id: I86a46aa2454be7fe80df608cb7e5573ca4029ec8
2023-07-14AsyncResolve cleanups and error handlingEd Tanous1-1/+1
The Async DBus resolver really has nothing to do with crow, which is our core http library namespace and has some opportunistic cleanups that can be done. This commit moves it into the bmcweb namespace (unimportantly) and breaks out one of the larger functions such that it can be unit tested, and unit tests it. Tested: Unit tests pass. Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: Ie3cfbb0ef81a027a1ad42358c04967a517471117
2023-07-11HTTP Client: Improve error messageSunitha Harish1-6/+12
This commit adds the host and port data to the existing error messages that are hit during redfish event Tested by: Checked the traces on BMC when there is a bad subscriber Change-Id: I3f18bc3b999c136c42c4c0021c5fcadddb9e4bff Signed-off-by: Sunitha Harish <sunithaharish04@gmail.com>
2023-07-11Implement data pointer clang-tidy checkEd Tanous1-1/+1
readability-container-data-pointer flags one error in our codebase, but can definitely find issues in patchsets. Fix the one error (that came from crow), and enable the check. Change-Id: I3045ec9a58d80300c90921dda1a2fe3859ffed7b Signed-off-by: Ed Tanous <edtanous@google.com>
2023-06-30Remove FunctionTraitsEd Tanous2-37/+6
This class is no longer really used or needed, and previously was largely replaced with boost::callable_traits. This moves the last usage of arg_t over to callable_traits. Tested: Redfish service validator passes This series of commits drops ~5 seconds from the bmcweb compile times in my testing. Change-Id: I2d0ac728d282e876232f5379f3bd6ff1ddede2ba Signed-off-by: Ed Tanous <edtanous@google.com>
2023-06-28HTTP/2 supportEd Tanous4-1/+739
HTTP/2 gives a number of optimizations, while keeping support for the protocol. HTTP/2 support was recently added to the Redfish specification. The largest performance increase in bmc usage is likely header compression. Almost all requests reuse the same header values, so the hpack based compression scheme in HTTP/2 allows OpenBMC to be more efficient as a transport, and has the potential to significantly reduce the number of bytes we're sending on the wire. This commit adds HTTP2 support to bmcweb through nghttp2 library. When static linked into bmcweb, this support adds 53.4KB to the bmcweb binary size. nghttp2 is available in meta-oe already. Given the experimental nature of this option, it is added under the meson option "experimental-http2" and disabled by default. The hope is to enable it at some point in the future. To accomplish the above, there a new class, HTTP2Connection is created. This is intended to isolate HTTP/2 connections code from HttpConnection such that it is far less likely to cause bugs, although it does duplicate about 20 lines of code (async_read_some, async_write_some, buffers, etc). This seems worth it for the moment. In a similar way to Websockets, when an HTTP/2 connection is detected through ALPN, the HTTP2Connection class will be instantiated, and the socket object passed to it, thus allowing the Connection class to be destroyed, and the HTTP2Connection to take over for the user. Tested: Redfish service validator passes with option enabled With option disabled GET /redfish/v1 in curl shows ALPN non negotiation, and fallback to http1.1 With the option enable GET /redfish/v1 in curl shows ALPN negotiates to HTTP2 Change-Id: I7839e457e0ba918b0695e04babddd0925ed3383c Signed-off-by: Ed Tanous <edtanous@google.com>
2023-06-28Remove the black_magic namespaceEd Tanous2-7/+3
The black_magic namespace has been eradicated of what most would call "black magic" and while there's some non-trivial stuff in there, it's far from the most complicated part of this stack. This commit takes the two remaining things in the black_magic namespace, namely the parameter tagging functionality, and moves them into the utility namespace. Tested: Redfish service validator passes Change-Id: I9e2686fff5ef498cafc4cb83d4d808ea849f7737 Signed-off-by: Ed Tanous <edtanous@google.com>
2023-06-28Simplify the routerEd Tanous4-204/+124
There's a lot of complexity left in the router. The recent decision to only support string arguments means that this can be significantly cleaned up. In some cases, this is done to simply expand the variadic template and handle all parameter cases up to 5 (which should be the max we ever see). While this might seem like it's not very DRY friendly (Don't repeat yourself) this is significantly better than what we had, which was very tough to deciper. Tested: Redfish service validator passes Change-Id: Ic72e54cffd7b9f4a85e6c9d143c45fa20530a2cd Signed-off-by: Ed Tanous <edtanous@google.com>
2023-06-27Remove computeParameterTagFromArgsListEd Tanous1-18/+0
This is no longer required, and was used previously when the router was more complex. Remove the unused methods. Usage of this was removed in: 15a42df0 Remove number support from the router Tested: Code compiles. Change-Id: Idd8b3e928077efc929b951f3bf520105ceea72e3 Signed-off-by: Ed Tanous <edtanous@google.com>
2023-06-27Remove now-unused isParameterTagCompatibleEd Tanous1-34/+0
Now that we only accept string-like arguments, as of the commit: 15a42df0 Remove number support from the router This function is no longer used or required. Tested: Code compiles. Change-Id: If5eedd9f5903db01b403c4e5b23fceb23d0d10e6 Signed-off-by: Ed Tanous <edtanous@google.com>
2023-06-24Break out request completion from connectionEd Tanous2-55/+63
There's a large part of the http::Connection class that has nothing to do with the connection at all, and is all about parsing, and finalizing the response. Break that portion out into its own method that can (in the future) be unit tested. Tested: Redfish service validator passes Change-Id: Ic608d432e69e25c0e0a1555ecc24ed62adba2664 Signed-off-by: Ed Tanous <edtanous@google.com>
2023-06-21Redfish: Implement SNMP TrapChicago Duan1-0/+8
Implement SNMPTrap in EventDestination of Redfish. We can use this Redfish interface to add/get/delete the SNMPTrap port and destination address. When the error log is generated, phosphor-snmp will send SNMPTrap messages to our configured SNMPTrap destination. The MIB is here: [1] https://github.com/openbmc/phosphor-snmp/blob/master/mibs/NotificationMIB.txt Refer: [1] https://www.dmtf.org/sites/default/files/standards/documents/DSP0268_2019.3.pdf SNMPTrap test: Tested ok on the Witherspoon machine. Steps are as follows: 1. Use this Redfish interface to configure the port and destination address: curl -k -H "X-Auth-Token: $token" -X POST https://${bmc}/redfish/v1/EventService/Subscriptions -d '{"Destination": "snmp://192.168.31.89:162", "SubscriptionType": "SNMPTrap", "Protocol": "SNMPv2c"}' 2. Run the SNMPTrap receiver tool in the destination computer(192.168.31.89),I used iReasoning MIB Browser as the SNMPTrap receiving tool. 3. Trigger error logs such as power supply AC Lost. We will see the error log under /xyz/openbmc_project/logging. 4. The SNMPTrap receiver tool in the destination computer received the SNMPTrap sent by OpenBMC. Tested: Validator passes 1. Add snmp client: curl -k -H "X-Auth-Token: $token" -X POST https://${bmc}/redfish/v1/EventService/Subscriptions -d '{"Destination": "snmp://192.168.31.89:162", "SubscriptionType": "SNMPTrap", "Protocol": "SNMPv2c", "Context": "testContext"}' { "@Message.ExtendedInfo": [ { "@odata.type": "#Message.v1_0_0.Message", "Message": "The resource has been created successfully", "MessageArgs": [], "MessageId": "Base.1.8.1.Created", "MessageSeverity": "OK", "Resolution": "None" } ] } 2. Get snmp trap client configurations: curl -k -H "X-Auth-Token: $token" -X GET https://${bmc}/redfish/v1/EventService/Subscriptions/snmp1 { "@odata.id": "/redfish/v1/EventService/Subscriptions/snmp1", "@odata.type": "#EventDestination.v1_7_0.EventDestination", "Context": "testContext", "Destination": "snmp://192.168.31.89:162", "EventFormatType": "Event", "Id": "snmp1", "Name": "Event Destination snmp1", "Protocol": "SNMPv2c", "SubscriptionType": "SNMPTrap" } Reboot the BMC, and get the snmp trap client again: curl -k -H "X-Auth-Token: $token" -X GET https://${bmc}/redfish/v1/EventService/Subscriptions/snmp1 { "@odata.id": "/redfish/v1/EventService/Subscriptions/snmp1", "@odata.type": "#EventDestination.v1_7_0.EventDestination", "Context": "testContext", "Destination": "snmp://192.168.31.89:162", "EventFormatType": "Event", "Id": "snmp1", "Name": "Event Destination snmp1", "Protocol": "SNMPv2c", "SubscriptionType": "SNMPTrap" } 3. Delete snmp client: curl -k -H "X-Auth-Token: $token" -X DELETE https://${bmc}/redfish/v1/EventService/Subscriptions/snmp1 { "@Message.ExtendedInfo": [ { "@odata.type": "#Message.v1_1_1.Message", "Message": "Successfully Completed Request", "MessageArgs": [], "MessageId": "Base.1.8.1.Success", "MessageSeverity": "OK", "Resolution": "None" } ] } 4. After we have added some SNMP clients using Redfish, we can see them in Dbus: busctl tree xyz.openbmc_project.Network.SNMP `-/xyz `-/xyz/openbmc_project `-/xyz/openbmc_project/network `-/xyz/openbmc_project/network/snmp `-/xyz/openbmc_project/network/snmp/manager |-/xyz/openbmc_project/network/snmp/manager/1 busctl introspect xyz.openbmc_project.Network.SNMP /xyz/openbmc_project/network/snmp/manager/1 xyz.openbmc_project.Network.Client NAME TYPE SIGNATURE RESULT/VALUE FLAGS .Address property s "192.168.31.89" emits-change writable .Port property q 162 emits-change writable 5. Use "busctl call" add client busctl call xyz.openbmc_project.Network.SNMP /xyz/openbmc_project/network/snmp/manager xyz.openbmc_project.Network.Client.Create Client sq 192.168.31.90 162 s "/xyz/openbmc_project/network/snmp/manager/2" We will see it use the redfish url: curl -k -H "X-Auth-Token: $token" -X GET https://${bmc}/redfish/v1/EventService/Subscriptions/snmp2 { "@odata.id": "/redfish/v1/EventService/Subscriptions/snmp2", "@odata.type": "#EventDestination.v1_7_0.EventDestination", "Context": "", "Destination": "snmp://192.168.31.90:162", "EventFormatType": "Event", "Id": "snmp2", "Name": "Event Destination snmp2", "Protocol": "SNMPv2c", "SubscriptionType": "SNMPTrap" } 6. Deleting snmp client using "busctl" First, we use redfish to add some SNMP clients: curl -k -H "X-Auth-Token: $token" -X POST https://${bmc}/redfish/v1/EventService/Subscriptions -d '{"Destination": "snmp://192.168.31.90:162", "SubscriptionType": "SNMPTrap", "Protocol": "SNMPv2c", "Context": "testContext0"}' curl -k -H "X-Auth-Token: $token" -X POST https://${bmc}/redfish/v1/EventService/Subscriptions -d '{"Destination": "snmp://192.168.31.91:162", "SubscriptionType": "SNMPTrap", "Protocol": "SNMPv2c", "Context": "testContext1"}' Then we can use redfish to get the subscriptions: curl -k -H "X-Auth-Token: $token" -XGET https://${bmc}/redfish/v1/EventService/Subscriptions { "@odata.id": "/redfish/v1/EventService/Subscriptions", "@odata.type":"#EventDestinationCollection.EventDestinationCollection", "Members": [ { "@odata.id": "/redfish/v1/EventService/Subscriptions/snmp1" }, { "@odata.id": "/redfish/v1/EventService/Subscriptions/snmp2" } ], "Members@odata.count": 2, "Name": "Event Destination Collections" } Now we use busctl to delete SNMP client 2: busctl call xyz.openbmc_project.Network.SNMP /xyz/openbmc_project/network/snmp/manager/2 xyz.openbmc_project.Object.Delete Delete Then we won't see snmp2 in the subscriptions of redfish: curl -k -H "X-Auth-Token: $token" -XGET https://${bmc}/redfish/v1/EventService/Subscriptions { "@odata.id": "/redfish/v1/EventService/Subscriptions", "@odata.type":"#EventDestinationCollection.EventDestinationCollection", "Members": [ { "@odata.id": "/redfish/v1/EventService/Subscriptions/snmp1" } ], "Members@odata.count": 1, "Name": "Event Destination Collections" } 7. Test the generic event subscription to make sure it didn't impacted Add Redfish subscription: curl -k -H "X-Auth-Token: $token" -X POST https://${bmc}/redfish/v1/EventService/Subscriptions -d '{"Destination": "https://192.168.31.189:443", "SubscriptionType": "RedfishEvent", "Protocol": "Redfish", "Context": "testContext"}' { "@Message.ExtendedInfo": [ { "@odata.type": "#Message.v1_1_1.Message", "Message": "The resource has been created successfully.", "MessageArgs": [], "MessageId": "Base.1.13.0.Created", "MessageSeverity": "OK", "Resolution": "None." } ] Get Redfish subscription: curl -k -H "X-Auth-Token: $token" -X GET https://${bmc}/redfish/v1/EventService/Subscriptions/1358109191 { "@odata.id": "/redfish/v1/EventService/Subscriptions/1358109191", "@odata.type": "#EventDestination.v1_8_0.EventDestination", "Context": "testContext", "DeliveryRetryPolicy": "TerminateAfterRetries", "Destination": "https://192.168.31.189:443", "EventFormatType": "Event", "HttpHeaders": [], "Id": "1358109191", "MessageIds": [], "MetricReportDefinitions": [], "Name": "Event Destination 1358109191", "Protocol": "Redfish", "RegistryPrefixes": [], "ResourceTypes": [], "SubscriptionType": "RedfishEvent" } Signed-off-by: Chicago Duan <duanzhijia01@inspur.com> Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: Ie589b3934ee749c7e0add35e3ed1b0b7e817c557
2023-06-17Revert "Fix websocket csrf checking"Ed Tanous1-1/+2
This reverts commit e628df8658c57f6943b6d3612e1077618e5a168a. This appears to cause problems with non-cookie login of the console websocket. This appears to be a gap in both our testing, and things that we have scripting to do, but clearly it's a change in behavior, so if we want to change the behavior, we should do it intentionally, and clearly, ideally with a path to make clients work, or an explicit documentation that the webui is the only supported client. Change-Id: I334257e1355a5b8431cb7ecfe58ef8a942f4981c Signed-off-by: Ed Tanous <edtanous@google.com>
2023-06-09Fix hack on Set-CookieEd Tanous1-2/+7
This is one that I couldn't figure out for a while. Turns out that fields has both a set() and an insert() method. Whereas set() replaces, insert() appends, which is what we want in this case. This allows us to call the actual methods several times, instead of essentially string injecting our own code, which should make it clearer. At the same time, there was one unit test that was structured such that it was using addHeader to clear a header, so this commit adds an explicit "clearHeader()" method, so we can be explicit. Tested: Logging into the webui in chrome (which uses POST /login) shows: 401 with no cookie header if the incorrect password is used 200 with 2 Set-Cookie headers set: Set-Cookie: SESSION=<session tag>; SameSite=Strict; Secure; HttpOnly Set-Cookie: XSRF-TOKEN=<token tag>; SameSite=Strict; Secure Change-Id: I9b87a48ea6ba892fc08e66940563dea86edb9a65 Signed-off-by: Ed Tanous <edtanous@google.com>
2023-06-09Break up router into separate filesEd Tanous7-761/+686
The router is a giant behemoth. Start breaking it down into pieces. Tested: Redfish service validator passes. Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: I9d04f53a58ffce3ecbd88dded1aa6e9648d2a762
2023-06-08Remove urlEncodeEd Tanous1-1/+1
All new uses should be using boost::urls::url now. This was the last usage. Tested: Logged into webui, and observed the correct URL behavior. In browser window /foobar Forwarded to /?next=/foobar#/login Which is correct. Note, this is different behavior slightly than before. It was found that the URI precedence goes query string THEN fragment, rather than the other way around that we had it. This was flagged when moving over to boost url structures. Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: Ifb354537d71a43c531d7d380dd889cf646731e39
2023-06-06Remove this->Ed Tanous2-4/+4
this-> is redundant when operating within a class member scope. We should aim to be consistent. This change was done automatically with sed replace Tested: Code compiles Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: If791e83e0bd5f84031e65156b7ea082ded8e158c
2023-06-06Add support for multiple consolesNinad Palsule2-6/+13
This drop adds support for multiple consoles. The following changes are made to achieve this. - Kept the "/console0" route for backward compatibility - Added a new route "/console/<str>" to support multiple consoles. All new consoles must use this route string. Testing: - Make sure that old console path /console0 is working. [INFO "http_connection.hpp":209] Request: 0x1bc2e60 HTTP/1.1 GET /console0 ::ffff:x.x.xx.xxx [DEBUG "routing.hpp":1240] Matched rule (upgrade) '/console0' 1 / 2 [DEBUG "obmc_console.hpp":212] Connection 0x1bdb67c opened [DEBUG "obmc_console.hpp":241] Console Object path = /xyz/openbmc_project/console/default service = xyz.openbmc_project.Console.default Request target = /console0 [DEBUG "obmc_console.hpp":198] Console web socket path: /console0 Console unix FD: 12 duped FD: 13 [DEBUG "obmc_console.hpp":82] Reading from socket [DEBUG "obmc_console.hpp":162] Remove connection 0x1bdb67c from obmc console - Make sure that new path for default console working [INFO "http_connection.hpp":209] Request: 0x1bd76a8 HTTP/1.1 GET /console/default ::ffff:x.x.xx.xxx [DEBUG "routing.hpp":1240] Matched rule (upgrade) '/console/<str>' 1 / 2 [DEBUG "obmc_console.hpp":212] Connection 0x1baf82c opened [DEBUG "obmc_console.hpp":241] Console Object path = /xyz/openbmc_project/console/default service = xyz.openbmc_project.Console.default Request target = /console/default [DEBUG "obmc_console.hpp":198] Console web socket path: /console/default Console unix FD: 12 duped FD: 13 [DEBUG "obmc_console.hpp":82] Reading from socket [INFO "obmc_console.hpp":154] Closing websocket. Reason: [DEBUG "obmc_console.hpp":162] Remove connection 0x1baf82c from obmc console - Make sure that path for hypervisor console is working. [INFO "http_connection.hpp":209] Request: 0x1bc2e60 HTTP/1.1 GET /console/hypervisor ::ffff:x.x.xx.xxx [DEBUG "routing.hpp":1240] Matched rule (upgrade) '/console/<str>' 1 / 2 [DEBUG "obmc_console.hpp":212] Connection 0x1bc5234 opened [DEBUG "obmc_console.hpp":241] Console Object path = /xyz/openbmc_project/console/hypervisor service = xyz.openbmc_project.Console.hypervisor Request target = /console/hypervisor [DEBUG "obmc_console.hpp":198] Console web socket path: /console/hypervisor Console unix FD: 12 duped FD: 13 [DEBUG "obmc_console.hpp":82] Reading from socket [INFO "obmc_console.hpp":154] Closing websocket. Reason: [DEBUG "obmc_console.hpp":162] Remove connection 0x1bc5234 from obmc console - Make sure that bad console path is failing properly due to DBUS error. [INFO "http_connection.hpp":209] Request: 0x1bd76a8 HTTP/1.1 GET /console/badconsoleid ::ffff:x.x.xx.xxx [DEBUG "routing.hpp":1240] Matched rule (upgrade) '/console/<str>' 1 / 2 [DEBUG "obmc_console.hpp":212] Connection 0x1bdb67c opened [DEBUG "obmc_console.hpp":241] Console Object path = /xyz/openbmc_project/console/badconsoleid service = xyz.openbmc_project.Console.badconsoleid Request target = /console/badconsoleid [ERROR "obmc_console.hpp":174] Failed to call console Connect() method DBUS error: No route to host Change-Id: I9b617bc51e3ddc605dd7f4d213c805d05d2cfead Signed-off-by: Ninad Palsule <ninad@linux.ibm.com> Signed-off-by: Ed Tanous <edtanous@google.com>
2023-06-05Break out serializer into its own cpp fileEd Tanous1-9/+1
This commit is entirely just moving code, such that not all compile units need to pull in the full html serializer. Tested: Unit tests pass. Pretty good coverage. Redfish service validator passes. Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: Ifaebe9534c0693dc678fd994517563b89aca0cc5
2023-06-05Add SSE style subscription support to eventserviceAppaRao Puli1-5/+5
This commit adds the SSE style eventservice subscription style event Using this, end user can subscribe for Redfish event logs using GET on SSE uris from browser. Tested: - From Browser did GET on above SSE URI and generated some Redfish event logs(power cycle) and saw redfish event logs streaming on browser. - After SSE registration, Check Subscription collections and GET on individual subscription and saw desired response. - Ran RedfishValidation and its passed. Change-Id: I7f4b7a34974080739c4ba968ed570489af0474de Signed-off-by: AppaRao Puli <apparao.puli@linux.intel.com> Signed-off-by: P Dheeraj Srujan Kumar <p.dheeraj.srujan.kumar@intel.com> Signed-off-by: Ed Tanous <edtanous@google.com>
2023-06-01Server-sent-event fixesEd Tanous5-175/+65
This makes several changes to server-sent events to allow it to merge to master. The routing system has been removed in leiu of using content-type eventstream detection. Timers have been added to the sse connections, and sse connections now rely on async_wait, rather than a full read. Tested: WIP Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: Id0ff0ebc2b3a795b3dba008e440556a9fdd882c2
2023-06-01Add Server-Sent-Event supportV-Sanjana5-4/+477
Server-Sent-Event is a standard describing how servers can initiate data transmission towards clients once an initial client connection has been established. Unlike websockets (which are bidirectional), Server-Sent-Events(SSE) are unidirectional and commonly used to send message updates or continuous data streams to a browser client. This is base patch for adding Server-Sent-Events routing support to bmcweb. Redfish EventService SSE style subscription uses SSE route for sending the Events/MetricReports to client which establishes the connection. Tested this patch with along with EventService SSE support patches and verified the functionalty on browser. Tested: - Tested using follow-up patches on top which adds support for Redfish EventService SSE style subscription and observed events are getting sent periodically. - Created SSE subscription from the browser by visiting https://<BMC IP>/redfish/v1/EventService/SSE Change-Id: I36956565cbba30c2007852c9471f477f6d1736e9 Signed-off-by: AppaRao Puli <apparao.puli@linux.intel.com> Signed-off-by: P Dheeraj Srujan Kumar <p.dheeraj.srujan.kumar@intel.com> Signed-off-by: V-Sanjana <sanjana.v@intel.com>
2023-05-30Allow async resolver to be optionalEd Tanous2-12/+25
This commit adds a meson option to allow selecting which dns resolver bmcweb uses. There are use cases, like Open Compute Project Inband Management Agent, that would require not using dbus, which would require us to fall back to the asio resolver. This commit makes the existing asio resolver constructor, and async_resolve methods match the equivalents in asio (which we intended to do anyway), then adds a macro and configure option for being able to select which resolver backend to rely on. Tested: Code can now compile without sdbusplus. Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: I3220214367179f131a60082bdfaf7e725d35c125
2023-05-25Fix some includesEd Tanous1-1/+1
System includes should be included with <>, in-tree includes should be included with "". This was found manually, with the help of the following grep statement[1]. git grep -o -h "#include .*" | sort | uniq Tested: Code compiles Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: I1a6b2a5ba35ccbbb61c67b7c4b036a2d7b3a36a3
2023-05-20Added new pre-defined usergroup called hostconsoleNinad Palsule1-13/+40
The new pre-defined usergroup named "hostconsole" is added to differentiate access between host console and manager console. The only users allowed to interact with host console are part of the "hostconsole" group and they are in an administrator role. Note: The changes are spread across multiple repositories listed under "Related commits:" The bmcweb changes to incorporate new group are as follows: - The new user is added in the hostconsole group only if it has an administrative role. - The ssh usergroup is only translated to ManagerConsole redfish group and hostconsole usergroup is translated to HostConsole redfish group. - The following changes are made to check the privileges for host console access - The new OEM privilege "OpenBMCHostConsole" added for host console access. This privilege is not shared externally hence it is not documented. - Updated obmc_console BMCWEB_ROUTE to use the new privilege. - Router functions now save user role and user groups in the session - getUserPrivileges() function now takes session reference instead of user role. This function now also checks for the user group "hostconsole" and add the new privilege if user is member of this group. - Updated all callers of the getUserPrivileges to pass session reference. - Added test to validate that new privilege is set correctly. Tested: Loaded code on the system and validated that; - New user gets added in hostconsole group. NOTE: Prior to this commit all groups are assigned to new user. This drop does not change that behavior. - Access from the web gui is only available for users in hostconsole group. Used IBM internal simulator called simics to test this. This simulator allows accessing openbmc from GUI. - Checked the role collection and there is no change. $ curl -k -H "X-Auth-Token: $TOKEN" -X GET \ https://${bmc}/redfish/v1/AccountService/Roles $ curl -k -H "X-Auth-Token: $TOKEN" -X GET \ https://${bmc}/redfish/v1/AccountService/Roles/Administrator $ curl -k -H "X-Auth-Token: $TOKEN" -X GET \ https://${bmc}/redfish/v1/AccountService/Roles/ReadOnly $ curl -k -H "X-Auth-Token: $TOKEN" -X GET \ https://${bmc}/redfish/v1/AccountService/Roles/Operator - HostConsole is in AccountType when hostconsole group is present in UserGroups D-Bus property $ id user99 uid=1006(user99) gid=100(users) groups=1000(priv-admin),1005(web),\ 1006(redfish),1013(hostconsole),100(users) $ curl -k https://${bmc}/redfish/v1/AccountService/Accounts/user99 { "@odata.id": "/redfish/v1/AccountService/Accounts/user99", "@odata.type": "#ManagerAccount.v1_4_0.ManagerAccount", "AccountTypes": [ "HostConsole", "Redfish", "WebUI", "ManagerConsole" ], "Description": "User Account", "Enabled": true, "Id": "user99", "Links": { "Role": { "@odata.id": "/redfish/v1/AccountService/Roles/Administrator" } }, "Locked": false, "Locked@Redfish.AllowableValues": [ "false" ], "Name": "User Account", "Password": null, "PasswordChangeRequired": false, "RoleId": "Administrator", "UserName": "user99" - The hostconsole group is not present for readonly or operator users and also made sure that console access is not provided. This testing is done one the system and console access was tried by modifying the https://github.com/openbmc/bmcweb/blob/master/scripts/websocket_test.py + curl -k https://${bmc}/redfish/v1/AccountService/Accounts/user99 { "@odata.id": "/redfish/v1/AccountService/Accounts/user99", "@odata.type": "#ManagerAccount.v1_4_0.ManagerAccount", "AccountTypes": [ "IPMI", "Redfish", "WebUI", "ManagerConsole" ], "Description": "User Account", "Enabled": true, "Id": "user99", "Links": { "Role": { "@odata.id": "/redfish/v1/AccountService/Roles/ReadOnly" } }, "Locked": false, "Locked@Redfish.AllowableValues": [ "false" ], "Name": "User Account", "Password": null, "PasswordChangeRequired": false, "RoleId": "ReadOnly", "UserName": "user99" [INFO "http_connection.hpp":209] Request: 0x150ac38 HTTP/1.1 GET /console0 ::ffff:x.x.xx.xxx [DEBUG "routing.hpp":1265] Matched rule (upgrade) '/console0' 1 / 2 [DEBUG "routing.hpp":1084] userName = user99 userRole = priv-user [DEBUG "routing.hpp":1123] IsUserPrivileged: group=ipmi [DEBUG "routing.hpp":1123] IsUserPrivileged: group=redfish [DEBUG "routing.hpp":1123] IsUserPrivileged: group=ssh [DEBUG "routing.hpp":1123] IsUserPrivileged: group=web [DEBUG "routing.hpp":93] checkPrivileges: BASE USER: Login [DEBUG "routing.hpp":93] checkPrivileges: BASE USER: ConfigureSelf [DEBUG "routing.hpp":113] checkPrivileges: OEM REQUIRED: OpenBMCHostConsole [ERROR "routing.hpp":1192] Insufficient Privilege + curl -k https://${bmc}/redfish/v1/AccountService/Accounts/user99 { "@odata.id": "/redfish/v1/AccountService/Accounts/user99", "@odata.type": "#ManagerAccount.v1_4_0.ManagerAccount", "AccountTypes": [ "IPMI", "Redfish", "WebUI", "ManagerConsole" ], "Description": "User Account", "Enabled": true, "Id": "user99", "Links": { "Role": { "@odata.id": "/redfish/v1/AccountService/Roles/Operator" } }, "Locked": false, "Locked@Redfish.AllowableValues": [ "false" ], "Name": "User Account", "Password": null, "PasswordChangeRequired": false, "RoleId": "Operator", "UserName": "user99" [INFO "http_connection.hpp":209] Request: 0x21c7c38 HTTP/1.1 GET /console0 ::ffff:x.x.xx.xxx [DEBUG "routing.hpp":1265] Matched rule (upgrade) '/console0' 1 / 2 [DEBUG "routing.hpp":1084] userName = user99 userRole = priv-operator [DEBUG "routing.hpp":1123] IsUserPrivileged: group=ipmi [DEBUG "routing.hpp":1123] IsUserPrivileged: group=redfish [DEBUG "routing.hpp":1123] IsUserPrivileged: group=ssh [DEBUG "routing.hpp":1123] IsUserPrivileged: group=web [DEBUG "routing.hpp":93] checkPrivileges: BASE USER: Login [DEBUG "routing.hpp":93] checkPrivileges: BASE USER: ConfigureComponents [DEBUG "routing.hpp":93] checkPrivileges: BASE USER: ConfigureSelf [DEBUG "routing.hpp":113] checkPrivileges: OEM REQUIRED: OpenBMCHostConsole [ERROR "routing.hpp":1192] Insufficient Privilege Related commits: NOTE: docs, openbmc, obmc-console changes are already merged. bmcweb and phosphor-user-manager will be merged together. docs: https://gerrit.openbmc.org/c/openbmc/docs/+/60968 phosphor-user-manager: https://gerrit.openbmc.org/c/openbmc/phosphor-user-manager/+/61583 openbmc: https://gerrit.openbmc.org/c/openbmc/openbmc/+/61582 obmc-console: https://gerrit.openbmc.org/c/openbmc/obmc-console/+/61581 bmcweb: https://gerrit.openbmc.org/c/openbmc/bmcweb/+/61580 Change-Id: Ia5a33dafc9a76444e6a8e74e752f0f90cb0a31c8 Signed-off-by: Ninad Palsule <ninadpalsule@us.ibm.com>
2023-05-19Capture all boost::system::error_codes by refEd Tanous2-4/+4
Capturing these possibly overloaded values by reference can avoid a copy in some cases, and it's good to be consistent. This change was made automatically by grep/sed. Tested: Code compiles. Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: Iafeaca2a5dc52f39753b5a3880419d6bc943f81b
2023-05-19Clear json objectEd Tanous1-2/+2
nlohmann::json::clear() has different behavior dependent on what the underlying object is, rather than doing the expected behavior of completely clearing the json object. This didn't matter because of a similar bug in http_connection that relied on nlohmann:json::empty() which is ALSO type dependent, so these worked. Unfortunately, in 02e01b5108d46720a0b438c0d79952464320d954 we wanted to allow empty objects, and this bug was exposed. There are two places where clear() is used, once in Response, which is clearly not the intent, which is to reset the object to the original constructed state. The other place we call clear is in Manager, where we use it to clear incremental results. That was a previous best practice that has been eliminated everywhere else (now we return as many results with the error as we are able). It has been removed. Tested: Logging into the webui in firefox no longer core dumps. Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: Ic89a037b30fb40c0e6eaeb939cae6e006dd0ffac
2023-05-19http_connection: Allow empty json objectsEd Tanous1-1/+1
Currently http_connection will produce empty body in the response if the res.jsonValue is empty, including empty array, object. This makes the output confusing in case a response does contain an empty object or array. Change the code to print the json object even if it's empty object or array. This patchset was previously reverted because of a regression, but this regression is fixed in 63529. Tested on previous commit: With an OEM URL that returns empty array depending on the system config, the response becomes `[]` instead of empty. Signed-off-by: Lei YU <yulei.sh@bytedance.com> Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: I1d1bf01a5277ff1bc953b15d9fc410e10f941e70
2023-05-19Clean up preparePayloadEd Tanous2-11/+27
boost::beast::http::message::prepare_payload [1] can throw, which isn't really the behavior we want (as it throws to the io_context). Luckily, every part of that function is using public methods, and we can simplify it. In past commits, we've worked around this issue: 6295becabb9edba2edb53a3c0dddc13d2ffac8dd This is an attempt to fix it properly. [1] https://github.com/boostorg/beast/blob/ae01f0201dbf940cbc32d96d7a78dc584a02ab26/include/boost/beast/http/impl/message.hpp#L398 Redfish service validator passes Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: Ie88ddeecfd226bba75a7659cfb7ddddd38eb27cb
2023-05-16Boost::urls::formatEd Tanous2-16/+5
Boost 1.82 dropped a lovely new toy, boost::urls::format, which is a lot like our urlFromPieces method, but better in that it makes the resulting uris more readable, and allows doing things like fragments in a single line instead of multiple. We should prefer it in some cases. Tested: Redfish service validator passes. Spot checks of URLs work as expected. Unit tests pass. Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: Ia7b38f0a95771c862507e7d5b4aa68aa1c98403c
2023-05-12Revert "http_connection: Allow empty json objects"Ed Tanous1-1/+1
This reverts commit 02e01b5108d46720a0b438c0d79952464320d954. This commit is being reverted because it causes login failures on Firefox browsers. This commit originally was added with the idea that it did not fix anything on upstream, but made some peoples forks better. It appears to have broken some upstream things, so the right thing to do is to revert it until those breakages can be understood. Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: I04de84fca1a8de657f6941653f2a3e595ee725d5
2023-05-12fix clang-tidy warnings with unreachable returnsPatrick Williams2-3/+0
``` /data0/jenkins/workspace/ci-repository/openbmc/bmcweb/http/verb.hpp:51:12: error: 'return' will never be executed [clang-diagnostic-unreachable-code-return,-warnings-as-errors] /data0/jenkins/workspace/ci-repository/openbmc/bmcweb/http/utility.hpp:99:12: error: 'return' will never be executed [clang-diagnostic-unreachable-code-return,-warnings-as-errors] /data0/jenkins/workspace/ci-repository/openbmc/bmcweb/redfish-core/include/utils/query_param.hpp:272:13: error: 'break' will never be executed [clang-diagnostic-unreachable-code-break,-warnings-as-errors] ``` Signed-off-by: Patrick Williams <patrick@stwcx.xyz> Change-Id: Ia74f4fb4f34875097d1ef04b26e40908cc175088
2023-05-12http-app: fix unused macro clang-tidy warningPatrick Williams1-1/+1
``` /data0/jenkins/workspace/ci-repository/openbmc/bmcweb/http/app.hpp:27:9: error: macro is not used [clang-diagnostic-unused-macros,-warnings-as-errors] #define BMCWEB_ROUTE(app, url) ``` Signed-off-by: Patrick Williams <patrick@stwcx.xyz> Change-Id: I49b6239d7d5f31c52af6f6e5b0bc57be22a299b5
2023-05-12http-logging: fix clang-tidy warningsPatrick Williams1-6/+5
``` /data0/jenkins/workspace/ci-repository/openbmc/bmcweb/http/logging.hpp:132:9: error: macro is not used [clang-diagnostic-unused-macros,-warnings-as-errors] #define BMCWEB_LOG_CRITICAL ``` Add NOLINTBEGIN/NOLINTEND guards around the whole of the macro definitions because there are now multiple clang-tidy warning types that call out this behavior, but we want it in this case. Signed-off-by: Patrick Williams <patrick@stwcx.xyz> Change-Id: Iac2ee839999f36424ca6dfed212d0bad0a2f3ae5
2023-05-11mutual-tls: fix clang-tidy warningPatrick Williams1-4/+4
``` ../http/mutual_tls.hpp:77:35: error: unsafe buffer access [-Werror,-Wunsafe-buffer-usage] unsigned char usageChar = usage->data[i]; ``` Signed-off-by: Patrick Williams <patrick@stwcx.xyz> Change-Id: Icc6905f31fdd54b683fe7807eb72e9b78437b2d1
2023-05-11clang-format: copy latest and re-formatPatrick Williams9-37/+25
clang-format-16 has some backwards incompatible changes that require additional settings for best compatibility and re-running the formatter. Copy the latest .clang-format from the docs repository and reformat the repository. Change-Id: I75f89d2959b0f1338c20d72ad669fbdc1d720835 Signed-off-by: Patrick Williams <patrick@stwcx.xyz>
2023-05-05Update Logging option for the setting log levelMyung Bae1-43/+58
In order to be able to more easily debug bmcweb related issue, a new meson option is added to set a specific logging level Which generates the targeted logging traces rather than all of debug traces. The current option -Dbmcweb-logging which can be either disabled or enabled is changed to allow to set the log level for the specific level traces (e.g. error or critical traces) to be written to the journal. -Dbmcweb-logging=<log-level> where <log-level> can be disabled, enabled, debug, info, warning, error, or critical. - `disabled`: Turns off all bmcweb log traces. - `enabled` : treated as `debug` - Other option can be described in [Logging Levels](DEVELOPING.md). For an example, to enable only 'error', 'critical' log entries, bmcweb can be built with -Dbmcweb-logging=error Testing: - Verified that only the specific logs (e.g. error and critical logs) were displayed by compiling bmcweb with the specific bmcweb-logging level. Change-Id: I522ca26700ea420fee1a5cf688d3e8c6661f2f55 Signed-off-by: Myung Bae <myungbae@us.ibm.com>
2023-04-27Remove nameStr from routerEd Tanous1-26/+2
It isn't used anywhere in the code, so it can be removed, and the router simplified. These common data structures have caused problems, in that they're not copied to child handlers, and cause bugs like #249. Tested: Redfish service validator passes. Basic sanity tests of both static file routes such as $metadata (which use DynamicRule) as well as method routes, such as /redfish/v1, return valid data. Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: I93ad74581912e18ee5db9aaa9ecdaf08ed765418
2023-04-27Remove number support from the routerEd Tanous3-489/+57
The router historically came from crow. Crow supported wildcards of <int>, <float>, and <double>. bmcweb doesn't use them, nor should it in basically any case, as we now have explicit 404 handling. This commit removes them. This amounts to about -450 lines of code, but it's some of the scarier code we have, some of it existing in the namespace "black_magic". Reducing the brain debt for people working in this subsystem seems worthwhile. There is no case in the future where we would use integer based url parameters. Tested: Redfish service validator passes. Should be good enough coverage for a code removal. Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: I34add8df7d3486952474ca7ec3dc6be990c50ed0
2023-04-25http_connection: Allow empty json objectsLei YU1-1/+1
Currently http_connection will produce empty body in the response if the res.jsonValue is empty, including empty array, object. This makes the output confusing in case a response does contain an empty object or array. Change the code to print the json object even if it's empty object or array, so that the output is consistent with the `res.jsonValue`. Tested: With an OEM URL that returns empty array depending on the system config, the response becomes `[]` instead of empty. Signed-off-by: Lei YU <yulei.sh@bytedance.com> Change-Id: Ie97378a2cffce7b1fd6586a56b6cfa7d5c476dc1
2023-04-18Copy privilegeset into websocket ruleEd Tanous1-0/+1
Resolves #249 Tested: Running websockets now shows rules being applied ``` Apr 10 20:26:35 p10bmc bmcweb[745]: (2023-04-10 20:26:35) [INFO "http_connection.hpp":209] Request: 0x11e3248 HTTP/1.1 GET /console0 ::ffff:X.XX.XX.XXX | Apr 10 20:26:35 p10bmc bmcweb[745]: (2023-04-10 20:26:35) [DEBUG "routing.hpp":1460] Matched rule (upgrade) '/console0' 1 / 2 Apr 10 20:26:36 p10bmc bmcweb[745]: (2023-04-10 20:26:36) [DEBUG "routing.hpp":1299] userName = admin userRole = priv-admin Apr 10 20:26:36 p10bmc bmcweb[745]: (2023-04-10 20:26:36) [DEBUG "routing.hpp":101] checkPrivileges: Active BASE priv: ConfigureManager <<<<<< Apr 10 20:26:36 p10bmc bmcweb[745]: (2023-04-10 20:26:36) [DEBUG "routing.hpp":101] checkPrivileges: Active BASE priv: ConfigureComponents <<<<<< Apr 10 20:26:36 p10bmc bmcweb[745]: (2023-04-10 20:26:36) [ERROR "routing.hpp":1361] isUserPrivileged: URL: /console0 IsPrivelegeSetEmpty: 0 Username: admin ``` Signed-off-by: Ed Tanous <edtanous@google.com> Tested-by: Ninad Palsule <ninadpalsule@us.ibm.com> Change-Id: Ia2eae1847822b50a425afd2e5e13b528393aa7ad
2023-04-06Fix websocket csrf checkingGunnar Mills1-2/+1
https://github.com/openbmc/bmcweb/commit/f8aa3d2704d3897eb724dab9ac596af8b1f0e33e (4/15/20) added CSRF check into websockets but later setting cookieAuth to true was removed so this session->cookieAuth is always false. https://github.com/openbmc/bmcweb/commit/3909dc82a003893812f598434d6c4558107afa28 (7/15/20). 2 choices here add back this cookieAuth=true when cookie auth is used or remove this "if cookieAuth" and do this check anytime BMCWEB_INSECURE_DISABLE_CSRF_PREVENTION isn't enabled. Really we shouldn't support any other auth on websockets so maybe if (!session->cookieAuth){ unauthorized; } if go with the first choice. Went with the 2nd choice because cleaner. This checking is a bit weird because it uses protocol for csrf checking. https://github.com/openbmc/webui-vue/blob/b63e9d9a70dabc4c9a7038f7727fca6bd17d940a/src/views/Operations/SerialOverLan/SerialOverLanConsole.vue#L98 Tested: Before could log in to webui-vue, delete the XSRF-TOKEN but still connect to the host console. After if deleted the XSRF-TOKEN (browser dev tools), the websocket does not connect. Don't have a system with KVM, VM enabled so wasn't able to check those but the webui-vue code for them looks to pass the token. The webui-vue host console works the same as before if you aren't messing with the XSRF-TOKEN. Change-Id: Ibd5910587648f68809c7fd518bcf5a0bcf8cf329 Signed-off-by: Gunnar Mills <gmills@us.ibm.com>
2023-03-23nbd proxy and websocket cleanupsEd Tanous2-25/+139
As-written, the nbd (and all websocket daemons) suffer from a problem where there is no way to apply socket backpressure, so in certain conditions, it's trivial to run the BMC out of memory on a given message. This is a problem. This commit implements the idea of an incremental callback handler, that accepts a callback function to be run when the processing of the message is complete. This allows applying backpressure on the socket, which in turn, should provide pressure back to the client, and prevent buffering crashes on slow connections, or connections with high latency. Tested: NBD proxy not upstream, no way to test. No changes made to normal websocket flow. Signed-off-by: Michal Orzel <michalx.orzel@intel.com> Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: I3f116cc91eeadc949579deacbeb2d9f5e0f4fa53
2023-03-23Remove authorization checks in nbd_proxyEd Tanous1-27/+2
nbd proxy should not have its own authorization checks, as these are now handled in the core as of 7e9093e625961f533250a6c193c1a474e98007c4 Signed-off-by: Ed Tanous <edtanous@google.com> Change-Id: I8874d8a09278ba21d2acfdf076cb76dee718ecf4
generated by cgit v1.2.3 (git 2.39.0) at 2026-10-01 08:14:30 +0300