bmcweb/crow, branch master

Make references to crow less obvious

2019-10-18T16:20:11+00:00

Recently, a number of people in the community have made the (admittedly easy) mistake that we use a significant portion of crow. Today, we use crow for the router, and the "app" structure, and even those have been significantly modified to meet the bmc needs. All other components have been replaced with Boost beast. This commit removes the crow mentions from the Readme, and moves the crow folder to "http" to camouflage it a little. No code content has changed. Tested: Code compiles. No functional change made to any executable code. Signed-off-by: Ed Tanous Change-Id: Iceb57b26306cc8bdcfc77f3874246338864fd118

Fix a bunch of warnings

2019-10-10T23:25:26+00:00

using the list of warnings from here: https://github.com/lefticus/cppbestpractices/blob/e73393f25a85f83fed7399d8b65cb117d00b2231/02-Use_the_Tools_Available.md#L100 Seems like a good place to start, and would improve things a bit type-wise. This patchset attempts to correct all the issues in one shot. Tested: It builds. Will test various subsystems that have been touched Signed-off-by: Ed Tanous Change-Id: I588c26440e5a97f718a0f0ea74cc84107d53aa1e

Fix role map persistence

2019-10-02T20:16:04+00:00

Now that we have a live role map, there's no need to track the users role in the session object, we have the ability to get it every time. This issue manifests itself in a fairly nefarious situation: 1. Log in, user is assigned a session, with role 2. BMC reboots. Session is persisted and restored, but role is removed. 3. User now has a valid session, but isn't authorized to do anything, which results in a 403. In the webui, this results in an inability to log out. Tested (TODO): Log in and log out functions. Reboot BMC, verify that webui doesn't log back out or return 403. Signed-off-by: Ed Tanous Change-Id: I9bbf682d062150aa1c877217f037221471e58e9f

Don't throw if no-content is provided

2019-09-16T22:29:42+00:00

In a perfect world, we would implement all no-content cases correctly, and never set a no-content return code, then provide content. In practice, in an async context, this is difficult to manage, as has been proven a couple times to be beyond what we're able to review. This error should be made less fatal, and still return a response to the user, rather than throwing and closing the connection entirely. This patchset implements a corrective action where the content is dropped in the connection if the handler sets the no-content code. Tested: Still need to test. In theory, not possible without a unit test for a buggy handler. Signed-off-by: Ed Tanous Change-Id: Ie6fea0c3fef107578b855b7c43a634d51b2064de

Fix SSL-disabled build

2019-09-16T14:45:25+00:00

This fixes a build error when BMCWEB_INSECURE_DISABLE_SSL is set to ON. Tested: Set BMCWEB_INSECURE_DISABLE_SSL to On and built successfully. Change-Id: Iabacff92098fff61c902b2c40873d66987811773 Signed-off-by: Jason M. Bills

Redfish(Authorization): Map the user role with the Redfish privileges

2019-07-11T01:29:29+00:00

This commit gets the role of the user from the session object and map it with the redfish privileges and then allow/reject the asked operation depending on the userprivileges and the entity privileges. Change-Id: I40be06c28e80b47fe76891cacf863f8495bace88 Signed-off-by: Ratan Gupta

Add FILE and LINE to log prints

2019-07-09T16:39:17+00:00

Some error prints are nondescriptive and this helps tell where the error happened Tested: Compiled with debug and saw error prints with filename and line number. Jul 08 18:52:26 intel-obmc bmcweb[1348]: (2019-07-08 18:52:26) [INFO "webserver_main.cpp":95] bmcweb (Jul 8 2019: 19:24:43) Jul 08 18:52:26 intel-obmc bmcweb[1348]: (2019-07-08 18:52:26) [INFO "webserver_main.cpp":34] attempting systemd socket activation Jul 08 18:52:26 intel-obmc bmcweb[1348]: (2019-07-08 18:52:26) [INFO "webserver_main.cpp":38] Starting webserver on socket handle 3 Jul 08 18:52:28 intel-obmc bmcweb[1348]: (2019-07-08 18:52:28) [INFO "http_server.h":182] Building SSL Context file="/etc/ssl/certs/https/server.pem" Jul 08 18:52:28 intel-obmc bmcweb[1348]: Checking certs in file /etc/ssl/certs/https/server.pem Jul 08 18:52:28 intel-obmc bmcweb[1348]: Found an EC key Jul 08 18:52:28 intel-obmc bmcweb[1348]: (2019-07-08 18:52:28) [INFO "app.h":186] app::ssl context use_count=2 Jul 08 18:52:28 intel-obmc bmcweb[1348]: (2019-07-08 18:52:28) [INFO "http_server.h":157] iBMC server is running, local endpoint [::]:443 Jul 08 18:52:28 intel-obmc bmcweb[1348]: (2019-07-08 18:52:28) [DEBUG "http_connection.h":267] 0xb43b48 Connection open, total 1 Change-Id: I9838d1863bcdd2d8401d3237729a8e7f134bfd07 Signed-off-by: James Feist

Response for insufficient privileges to 403

2019-06-20T16:39:35+00:00

Currently, if the user does not have sufficient privileges a 401 (Unauthorized) is returned. A 403 (Forbidden) should be returned instead. This change does this. The Web Interface forces the user to reauthenticate on a 401. https://github.com/openbmc/phosphor-webui/blob/e364faa0314c8c98a31260bf69df78a104b106a1/app/common/services/apiInterceptor.js#L50 Maybe not the best policy but a 401 roughly means "Not or incorrectly authenticated, please reauthenticate". A 403 roughly means "As this user you don't have permission". See https://stackoverflow.com/questions/3297048/403-forbidden-vs-401-unauthorized-http-responses and http://www.dirv.me/blog/2011/07/18/understanding-403-forbidden/index.html Tested: None. Change-Id: I07a89dc542002c6aeb66da96822fdb466528c383 Signed-off-by: Gunnar Mills

Redfish: Add certificate service to manage HTTPS certificates

2019-06-12T22:53:05+00:00

Implements CertificateService schema to list the actions available. Implements CertificateLocations schema to list the certificates present in the system. Implements CertificateCollection schema to upload/list existing HTTPS certificates Implements Certificate schema to view existing HTTPS certificate Cater for reloading the SSL context after a certificate is uploaded. Fix Certificate signature validation failure At present bmcweb uses the certificate from "/home/root/server.pem" the same is modified to "/etc/ssl/certs/https/server.pem" as phosphor-certificate-manager uses the specified path to install/replace certificates. Bmcweb creates a self-signed certificate when certificate is not present. Catered for creating "/etc/ssl/certs/https/" direcotry structure so that self signed certificate is created in the path. Implements ReplaceCertificate action of Certificate Service for replacing existing HTTPS certificates Cleanup of older self-signed certificate at /home/root/server.pem 1. Tested schema with validator and no issues 2. Privilege map for certificate service is not yet pubished 2. GET on /redfish/v1/CertificateService/ "CertificateService": { "@odata.id": "/redfish/v1/CertificateService" }, 3. GET on /redfish/v1/CertificateService/CertificateLocations/ "@odata.context": "/redfish/v1/$metadata#CertificateLocations.CertificateLocations", "@odata.id": "/redfish/v1/CertificateService/CertificateLocations", "@odata.type": "#CertificateLocations.v1_0_0.CertificateLocations", "Description": "Defines a resource that an administrator can use in order to locate all certificates installed on a given service", "Id": "CertificateLocations", "Name": "Certificate Locations" 4.POST on /redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates { Returns contents of certificate "@odata.context": "/redfish/v1/$metadata#Certificate.Certificate", "@odata.id": "/redfish/v1/AccountService/LDAP/Certificates/1", "@odata.type": "#Certificate.v1A_0_0.Certificate", "Id": "1", "Issuer": { ... ... } 5.GET on /redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/ { "@odata.context": "/redfish/v1/$metadata#CertificateCollection.CertificateCollection", "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates", "@odata.type": "#CertificateCollection.CertificatesCollection", "Description": "A Collection of HTTPS certificate instances", "Members": [ { "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1" } ], "Members@odata.count": 1, "Name": "HTTPS Certificate Collection" } 6.GET on /redfish/v1/CertificateService/CertificateLocations/ { "@odata.context": "/redfish/v1/$metadata#CertificateLocations.CertificateLocations", "@odata.id": "/redfish/v1/CertificateService/CertificateLocations", "@odata.type": "#CertificateLocations.v1_0_0.CertificateLocations", "Description": "Defines a resource that an administrator can use in order to locate all certificates installed on a given service", "Id": "CertificateLocations", "Links": { "Certificates": [ { "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1" } ], "Certificates@odata.count": 1 }, "Name": "Certificate Locations" } 7.GET on /redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1 { "@odata.context": "/redfish/v1/$metadata#Certificate.Certificate", "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1", "@odata.type": "#Certificate.v1_0_0.Certificate", "CertificateString": "-----BEGINCERTIFICATE-----\n....\n-----ENDCERTIFICATE-----\n", "CertificateType": "PEM", "Description": "HTTPS Certificate", "Id": "1", "Issuer": { } 8. Verified SSL context is reloaded after a certificate is installed. 9.curl -c cjar -b cjar -k -H "X-Auth-Token: $bmc_token" -X POST https://${bmc}/redfish/v1/CertificateService/Actions/CertificateService.ReplaceCertificate/ -d @data_https.json { "@odata.context": "/redfish/v1/$metadata#Certificate.Certificate", "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1", "@odata.type": "#Certificate.v1_0_0.Certificate", "CertificateString": "-----BEGIN CERTIFICATE----END CERTIFICATE-----\n", "Description": "HTTPS certificate", "Id": "1", "Issuer": { } 4. data_https.json file contents { "CertificateString": "-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDClW1COSab2O0W\nW0SgTzLxQ1Igl4EpbEmTK8CAQ+wI7loTDZ7sZwYdf6yc9TAs/yNKjlJljgedGszv\nbC7sPNpH4FA63kaM6TbBBKTRshwZ3myXiBOOkOBs6w6V7+c7uEPcMFge6/4W1VXD\nReMi016cnPWZsmQyGzpmPM49YNEDZBfdKZ/pLuCYc9L9t706U7FrUSGfM7swB+mC\n8NH9qMixMuWAV9SBvzUWI6p4OCmN8a/F+4lOdbPMVEUqQ0hCBCjGM4qmiy/5Ng6y\n6rKeJlUdmOSTk8ojrNGcOXKh0nRafNEQFkIuoPHt8k5B/Yw2CX6s2BoGwvF+hS03\n+z3qVSw3AgMBAAECggEBAKpe92kybRGr3/rhMrdCYRJJpZEP1nGUdN89QbGMxxAS\n0h84n9vRYNNXRKWxMNtVEWtoLdDpiNUP8Dv59yO1LFIen2DL2e3rDJv4Gu/YCS7F\nR0NuS+FaDIaRURYLFeV+MzyJv75jVvhbFlqByJxngcGS1KAcSApvOLTnrJSlPpy9\n8ec5gnDhdOUND9PaQt8xCqMs1RPpjqvrgRzMEodZoqT5v+b0K1GmsAdbSHNP2mLM\nrqtpFDefiM1YfsTHUtxQykxG2Ipd2jzJ0a8O0qmVqdXcP9J9aqLcmD/2/r96GEV6\n/5qvIBj3SRFobxCiCwfys2XOXfjz2J+BUZzGoZvKeRECgYEA518hT6mn46LhwrTI\nW+Qpi7iTJgOfeLC+Ng855VHVQFED1P3T2lfyfGDyqKI/wV1DJIJmO8iOXerSPnhi\nb7reQkyHj6ERUtuE+6BQ9oTw2QD3EEvzOK2PEH5UipbhVTDnC3fT62Vz2yb3tR8D\n2h0XVJkj/dng9p1Td5aDGMriRRMCgYEA10vTyYqBPjDIEYw/Sc9aQk2kT6x3hrRQ\ngR4xyuI31RTCRD/KpLh/7z4s11Wkr+F9CyASeLbqu6zymlLOlS5p7IUkJ/x2X027\nJWVY1SR+oF3iF3SHiP4XkOVvWOKwIVUhgTjK1+Di6i3AlwIeAOS7VCCP6W0gbnwJ\nyyAAHZ30NM0CgYAqTur4dj2NEqvVvtkkdIRkWEwQF3mByE//8qjTljM4n5fjysaC\nlrJwrAmzbHfcFAHDG1U2eWYPJnFrmvflFnauCPCBAyL308xtdtNXQNgJ1nNXN4wy\nQQp4KaGr9gseWOLm5fKKiPK2kFmbdSBvMgKiJZ6/PKg2cG5i39L5JaBaoQKBgApw\nqOJ7Du1fHDSNonwHzA6vCSq76Efl8olwV2XJNn/ks87vcPov4DRPxYjjpErLGm8x\nrPOhmxxitJj7Lv1Y9NX9VtWBjpPshwi3M2mSjXllVBNjGTdxat8h4RZkV7omEKvd\nfyicxSQp987a0W2lqdfYhGIDYrE43pi1AoxtHmx5AoGBAJSoRy62oZbW6vjfdkuf\nvVnjNfFZwuiPV/X2NT+BhNPe5ZKFtC6gGedHLaIBBD3ItRhGuHZxgWXccPjGHofi\n6DlPdp2NePJgDT2maSjGSiAcHxyXdmW+Ev27NblvAxktoTUcVqSENrKFb+Fh4FXN\nlXiJzOEwAXiP2ZFbMRyNF/MI\n-----END PRIVATE KEY-----\n-----BEGIN CERTIFICATE-----\nMIIDNzCCAh+gAwIBAgIJAI1Wr/fK5F0GMA0GCSqGSIb3DQEBCwUAMDIxHDAaBgNV\nBAoME29wZW5ibWMtcHJvamVjdC54eXoxEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0x\nOTAyMDExMzIyMDhaFw0yOTAxMjkxMzIyMDhaMDIxHDAaBgNVBAoME29wZW5ibWMt\ncHJvamVjdC54eXoxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\nBQADggEPADCCAQoCggEBAMKVbUI5JpvY7RZbRKBPMvFDUiCXgSlsSZMrwIBD7Aju\nWhMNnuxnBh1/rJz1MCz/I0qOUmWOB50azO9sLuw82kfgUDreRozpNsEEpNGyHBne\nbJeIE46Q4GzrDpXv5zu4Q9wwWB7r/hbVVcNF4yLTXpyc9ZmyZDIbOmY8zj1g0QNk\nF90pn+ku4Jhz0v23vTpTsWtRIZ8zuzAH6YLw0f2oyLEy5YBX1IG/NRYjqng4KY3x\nr8X7iU51s8xURSpDSEIEKMYziqaLL/k2DrLqsp4mVR2Y5JOTyiOs0Zw5cqHSdFp8\n0RAWQi6g8e3yTkH9jDYJfqzYGgbC8X6FLTf7PepVLDcCAwEAAaNQME4wHQYDVR0O\nBBYEFDDohRZ1+QlC3WdIkOAdBHXVyW/SMB8GA1UdIwQYMBaAFDDohRZ1+QlC3WdI\nkOAdBHXVyW/SMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFN0DWy6\nYPXHzidWMKKyQiJ5diqUv6LbujKOHUk+/LGSoCqcUp8NvmFDKWYP9MxjOAi9TVbs\nRGlIHBl38oSwKUayXBTY/vVeSLls90giUAOjswoRbBBQZvKyfEuFpc1zUsrhGLDC\n/6DuRt9l0DWcMcmP6Yh3jePIIwTr3bpxBGrwNLly8fPf16q4bWRIAcI3ZgLOhsrN\nLfD2kf56oYViM44d54Wa0qjuCfeTnJ46x/lo6w2kB9IzF7lwpipMU7+AG8ijDdaQ\nn8t0nADpv6tNNargLcOTTfJ0/P2PaKxwA1B88NhjlymBnNbz4epIn4T3KyysgS62\nzwqs66LPWoDerzc=\n-----END CERTIFICATE-----", "CertificateType": "PEM", "CertificateUri": { "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1" } } Change-Id: I2acbf8afa06bbf7d029d4971f7ab3b3988f5f060 Signed-off-by: Marri Devender Rao Signed-off-by: Ed Tanous

Add security headers to websockets

2019-05-29T21:16:49+00:00

websocket connections are by definition temporal, and cannot be cached. Unfortunately, certain security scanners don't see it that way, and flag errors on lack of CSP, XSS, and Content-Type headers when giving a websocket upgrade response. This commit adds the: Strict-Transport-Security Pragma Cache-Control Content-security-policy X-XSS-Protection X-Content-Type-Options Headers to the response when an upgrade occurs, to make the security scanners happy. Tested: Opened the main application, obseved the /subscribe api. Signed-off-by: Ed Tanous Change-Id: If76dc54f6501b3eb2caf44913d254a8b32d3fd30