summaryrefslogtreecommitdiffstats
path: root/crow
Commit message (Collapse)AuthorAgeFilesLines
* Make references to crow less obviousEd Tanous2019-10-1817-4856/+0
| | | | | | | | | | | | | | | | | Recently, a number of people in the community have made the (admittedly easy) mistake that we use a significant portion of crow. Today, we use crow for the router, and the "app" structure, and even those have been significantly modified to meet the bmc needs. All other components have been replaced with Boost beast. This commit removes the crow mentions from the Readme, and moves the crow folder to "http" to camouflage it a little. No code content has changed. Tested: Code compiles. No functional change made to any executable code. Signed-off-by: Ed Tanous <ed.tanous@intel.com> Change-Id: Iceb57b26306cc8bdcfc77f3874246338864fd118
* Fix a bunch of warningsEd Tanous2019-10-1012-226/+204
| | | | | | | | | | | | | | | using the list of warnings from here: https://github.com/lefticus/cppbestpractices/blob/e73393f25a85f83fed7399d8b65cb117d00b2231/02-Use_the_Tools_Available.md#L100 Seems like a good place to start, and would improve things a bit type-wise. This patchset attempts to correct all the issues in one shot. Tested: It builds. Will test various subsystems that have been touched Signed-off-by: Ed Tanous <ed.tanous@intel.com> Change-Id: I588c26440e5a97f718a0f0ea74cc84107d53aa1e
* Fix role map persistenceEd Tanous2019-10-021-1/+3
| | | | | | | | | | | | | | | | | | | Now that we have a live role map, there's no need to track the users role in the session object, we have the ability to get it every time. This issue manifests itself in a fairly nefarious situation: 1. Log in, user is assigned a session, with role 2. BMC reboots. Session is persisted and restored, but role is removed. 3. User now has a valid session, but isn't authorized to do anything, which results in a 403. In the webui, this results in an inability to log out. Tested (TODO): Log in and log out functions. Reboot BMC, verify that webui doesn't log back out or return 403. Signed-off-by: Ed Tanous <ed.tanous@intel.com> Change-Id: I9bbf682d062150aa1c877217f037221471e58e9f
* Don't throw if no-content is providedEd Tanous2019-09-161-0/+11
| | | | | | | | | | | | | | | | | | | In a perfect world, we would implement all no-content cases correctly, and never set a no-content return code, then provide content. In practice, in an async context, this is difficult to manage, as has been proven a couple times to be beyond what we're able to review. This error should be made less fatal, and still return a response to the user, rather than throwing and closing the connection entirely. This patchset implements a corrective action where the content is dropped in the connection if the handler sets the no-content code. Tested: Still need to test. In theory, not possible without a unit test for a buggy handler. Signed-off-by: Ed Tanous <ed.tanous@intel.com> Change-Id: Ie6fea0c3fef107578b855b7c43a634d51b2064de
* Fix SSL-disabled buildJason M. Bills2019-09-161-3/+3
| | | | | | | | | | | This fixes a build error when BMCWEB_INSECURE_DISABLE_SSL is set to ON. Tested: Set BMCWEB_INSECURE_DISABLE_SSL to On and built successfully. Change-Id: Iabacff92098fff61c902b2c40873d66987811773 Signed-off-by: Jason M. Bills <jason.m.bills@linux.intel.com>
* Redfish(Authorization): Map the user role with the Redfish privilegesRatan Gupta2019-07-112-5/+16
| | | | | | | | | This commit gets the role of the user from the session object and map it with the redfish privileges and then allow/reject the asked operation depending on the userprivileges and the entity privileges. Change-Id: I40be06c28e80b47fe76891cacf863f8495bace88 Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
* Add __FILE__ and __LINE__ to log printsJames Feist2019-07-091-7/+12
| | | | | | | | | | | | | | | | | | | | | Some error prints are nondescriptive and this helps tell where the error happened Tested: Compiled with debug and saw error prints with filename and line number. Jul 08 18:52:26 intel-obmc bmcweb[1348]: (2019-07-08 18:52:26) [INFO "webserver_main.cpp":95] bmcweb (Jul 8 2019: 19:24:43) Jul 08 18:52:26 intel-obmc bmcweb[1348]: (2019-07-08 18:52:26) [INFO "webserver_main.cpp":34] attempting systemd socket activation Jul 08 18:52:26 intel-obmc bmcweb[1348]: (2019-07-08 18:52:26) [INFO "webserver_main.cpp":38] Starting webserver on socket handle 3 Jul 08 18:52:28 intel-obmc bmcweb[1348]: (2019-07-08 18:52:28) [INFO "http_server.h":182] Building SSL Context file="/etc/ssl/certs/https/server.pem" Jul 08 18:52:28 intel-obmc bmcweb[1348]: Checking certs in file /etc/ssl/certs/https/server.pem Jul 08 18:52:28 intel-obmc bmcweb[1348]: Found an EC key Jul 08 18:52:28 intel-obmc bmcweb[1348]: (2019-07-08 18:52:28) [INFO "app.h":186] app::ssl context use_count=2 Jul 08 18:52:28 intel-obmc bmcweb[1348]: (2019-07-08 18:52:28) [INFO "http_server.h":157] iBMC server is running, local endpoint [::]:443 Jul 08 18:52:28 intel-obmc bmcweb[1348]: (2019-07-08 18:52:28) [DEBUG "http_connection.h":267] 0xb43b48 Connection open, total 1 Change-Id: I9838d1863bcdd2d8401d3237729a8e7f134bfd07 Signed-off-by: James Feist <james.feist@linux.intel.com>
* Response for insufficient privileges to 403Gunnar Mills2019-06-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Currently, if the user does not have sufficient privileges a 401 (Unauthorized) is returned. A 403 (Forbidden) should be returned instead. This change does this. The Web Interface forces the user to reauthenticate on a 401. https://github.com/openbmc/phosphor-webui/blob/e364faa0314c8c98a31260bf69df78a104b106a1/app/common/services/apiInterceptor.js#L50 Maybe not the best policy but a 401 roughly means "Not or incorrectly authenticated, please reauthenticate". A 403 roughly means "As this user you don't have permission". See https://stackoverflow.com/questions/3297048/403-forbidden-vs-401-unauthorized-http-responses and http://www.dirv.me/blog/2011/07/18/understanding-403-forbidden/index.html Tested: None. Change-Id: I07a89dc542002c6aeb66da96822fdb466528c383 Signed-off-by: Gunnar Mills <gmills@us.ibm.com>
* Redfish: Add certificate service to manage HTTPS certificatesMarri Devender Rao2019-06-122-33/+92
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implements CertificateService schema to list the actions available. Implements CertificateLocations schema to list the certificates present in the system. Implements CertificateCollection schema to upload/list existing HTTPS certificates Implements Certificate schema to view existing HTTPS certificate Cater for reloading the SSL context after a certificate is uploaded. Fix Certificate signature validation failure At present bmcweb uses the certificate from "/home/root/server.pem" the same is modified to "/etc/ssl/certs/https/server.pem" as phosphor-certificate-manager uses the specified path to install/replace certificates. Bmcweb creates a self-signed certificate when certificate is not present. Catered for creating "/etc/ssl/certs/https/" direcotry structure so that self signed certificate is created in the path. Implements ReplaceCertificate action of Certificate Service for replacing existing HTTPS certificates Cleanup of older self-signed certificate at /home/root/server.pem 1. Tested schema with validator and no issues 2. Privilege map for certificate service is not yet pubished 2. GET on /redfish/v1/CertificateService/ "CertificateService": { "@odata.id": "/redfish/v1/CertificateService" }, 3. GET on /redfish/v1/CertificateService/CertificateLocations/ "@odata.context": "/redfish/v1/$metadata#CertificateLocations.CertificateLocations", "@odata.id": "/redfish/v1/CertificateService/CertificateLocations", "@odata.type": "#CertificateLocations.v1_0_0.CertificateLocations", "Description": "Defines a resource that an administrator can use in order to locate all certificates installed on a given service", "Id": "CertificateLocations", "Name": "Certificate Locations" 4.POST on /redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates { Returns contents of certificate "@odata.context": "/redfish/v1/$metadata#Certificate.Certificate", "@odata.id": "/redfish/v1/AccountService/LDAP/Certificates/1", "@odata.type": "#Certificate.v1A_0_0.Certificate", "Id": "1", "Issuer": { ... ... } 5.GET on /redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/ { "@odata.context": "/redfish/v1/$metadata#CertificateCollection.CertificateCollection", "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates", "@odata.type": "#CertificateCollection.CertificatesCollection", "Description": "A Collection of HTTPS certificate instances", "Members": [ { "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1" } ], "Members@odata.count": 1, "Name": "HTTPS Certificate Collection" } 6.GET on /redfish/v1/CertificateService/CertificateLocations/ { "@odata.context": "/redfish/v1/$metadata#CertificateLocations.CertificateLocations", "@odata.id": "/redfish/v1/CertificateService/CertificateLocations", "@odata.type": "#CertificateLocations.v1_0_0.CertificateLocations", "Description": "Defines a resource that an administrator can use in order to locate all certificates installed on a given service", "Id": "CertificateLocations", "Links": { "Certificates": [ { "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1" } ], "Certificates@odata.count": 1 }, "Name": "Certificate Locations" } 7.GET on /redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1 { "@odata.context": "/redfish/v1/$metadata#Certificate.Certificate", "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1", "@odata.type": "#Certificate.v1_0_0.Certificate", "CertificateString": "-----BEGINCERTIFICATE-----\n....\n-----ENDCERTIFICATE-----\n", "CertificateType": "PEM", "Description": "HTTPS Certificate", "Id": "1", "Issuer": { } 8. Verified SSL context is reloaded after a certificate is installed. 9.curl -c cjar -b cjar -k -H "X-Auth-Token: $bmc_token" -X POST https://${bmc}/redfish/v1/CertificateService/Actions/CertificateService.ReplaceCertificate/ -d @data_https.json { "@odata.context": "/redfish/v1/$metadata#Certificate.Certificate", "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1", "@odata.type": "#Certificate.v1_0_0.Certificate", "CertificateString": "-----BEGIN CERTIFICATE----END CERTIFICATE-----\n", "Description": "HTTPS certificate", "Id": "1", "Issuer": { } 4. data_https.json file contents { "CertificateString": "-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDClW1COSab2O0W\nW0SgTzLxQ1Igl4EpbEmTK8CAQ+wI7loTDZ7sZwYdf6yc9TAs/yNKjlJljgedGszv\nbC7sPNpH4FA63kaM6TbBBKTRshwZ3myXiBOOkOBs6w6V7+c7uEPcMFge6/4W1VXD\nReMi016cnPWZsmQyGzpmPM49YNEDZBfdKZ/pLuCYc9L9t706U7FrUSGfM7swB+mC\n8NH9qMixMuWAV9SBvzUWI6p4OCmN8a/F+4lOdbPMVEUqQ0hCBCjGM4qmiy/5Ng6y\n6rKeJlUdmOSTk8ojrNGcOXKh0nRafNEQFkIuoPHt8k5B/Yw2CX6s2BoGwvF+hS03\n+z3qVSw3AgMBAAECggEBAKpe92kybRGr3/rhMrdCYRJJpZEP1nGUdN89QbGMxxAS\n0h84n9vRYNNXRKWxMNtVEWtoLdDpiNUP8Dv59yO1LFIen2DL2e3rDJv4Gu/YCS7F\nR0NuS+FaDIaRURYLFeV+MzyJv75jVvhbFlqByJxngcGS1KAcSApvOLTnrJSlPpy9\n8ec5gnDhdOUND9PaQt8xCqMs1RPpjqvrgRzMEodZoqT5v+b0K1GmsAdbSHNP2mLM\nrqtpFDefiM1YfsTHUtxQykxG2Ipd2jzJ0a8O0qmVqdXcP9J9aqLcmD/2/r96GEV6\n/5qvIBj3SRFobxCiCwfys2XOXfjz2J+BUZzGoZvKeRECgYEA518hT6mn46LhwrTI\nW+Qpi7iTJgOfeLC+Ng855VHVQFED1P3T2lfyfGDyqKI/wV1DJIJmO8iOXerSPnhi\nb7reQkyHj6ERUtuE+6BQ9oTw2QD3EEvzOK2PEH5UipbhVTDnC3fT62Vz2yb3tR8D\n2h0XVJkj/dng9p1Td5aDGMriRRMCgYEA10vTyYqBPjDIEYw/Sc9aQk2kT6x3hrRQ\ngR4xyuI31RTCRD/KpLh/7z4s11Wkr+F9CyASeLbqu6zymlLOlS5p7IUkJ/x2X027\nJWVY1SR+oF3iF3SHiP4XkOVvWOKwIVUhgTjK1+Di6i3AlwIeAOS7VCCP6W0gbnwJ\nyyAAHZ30NM0CgYAqTur4dj2NEqvVvtkkdIRkWEwQF3mByE//8qjTljM4n5fjysaC\nlrJwrAmzbHfcFAHDG1U2eWYPJnFrmvflFnauCPCBAyL308xtdtNXQNgJ1nNXN4wy\nQQp4KaGr9gseWOLm5fKKiPK2kFmbdSBvMgKiJZ6/PKg2cG5i39L5JaBaoQKBgApw\nqOJ7Du1fHDSNonwHzA6vCSq76Efl8olwV2XJNn/ks87vcPov4DRPxYjjpErLGm8x\nrPOhmxxitJj7Lv1Y9NX9VtWBjpPshwi3M2mSjXllVBNjGTdxat8h4RZkV7omEKvd\nfyicxSQp987a0W2lqdfYhGIDYrE43pi1AoxtHmx5AoGBAJSoRy62oZbW6vjfdkuf\nvVnjNfFZwuiPV/X2NT+BhNPe5ZKFtC6gGedHLaIBBD3ItRhGuHZxgWXccPjGHofi\n6DlPdp2NePJgDT2maSjGSiAcHxyXdmW+Ev27NblvAxktoTUcVqSENrKFb+Fh4FXN\nlXiJzOEwAXiP2ZFbMRyNF/MI\n-----END PRIVATE KEY-----\n-----BEGIN CERTIFICATE-----\nMIIDNzCCAh+gAwIBAgIJAI1Wr/fK5F0GMA0GCSqGSIb3DQEBCwUAMDIxHDAaBgNV\nBAoME29wZW5ibWMtcHJvamVjdC54eXoxEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0x\nOTAyMDExMzIyMDhaFw0yOTAxMjkxMzIyMDhaMDIxHDAaBgNVBAoME29wZW5ibWMt\ncHJvamVjdC54eXoxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\nBQADggEPADCCAQoCggEBAMKVbUI5JpvY7RZbRKBPMvFDUiCXgSlsSZMrwIBD7Aju\nWhMNnuxnBh1/rJz1MCz/I0qOUmWOB50azO9sLuw82kfgUDreRozpNsEEpNGyHBne\nbJeIE46Q4GzrDpXv5zu4Q9wwWB7r/hbVVcNF4yLTXpyc9ZmyZDIbOmY8zj1g0QNk\nF90pn+ku4Jhz0v23vTpTsWtRIZ8zuzAH6YLw0f2oyLEy5YBX1IG/NRYjqng4KY3x\nr8X7iU51s8xURSpDSEIEKMYziqaLL/k2DrLqsp4mVR2Y5JOTyiOs0Zw5cqHSdFp8\n0RAWQi6g8e3yTkH9jDYJfqzYGgbC8X6FLTf7PepVLDcCAwEAAaNQME4wHQYDVR0O\nBBYEFDDohRZ1+QlC3WdIkOAdBHXVyW/SMB8GA1UdIwQYMBaAFDDohRZ1+QlC3WdI\nkOAdBHXVyW/SMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFN0DWy6\nYPXHzidWMKKyQiJ5diqUv6LbujKOHUk+/LGSoCqcUp8NvmFDKWYP9MxjOAi9TVbs\nRGlIHBl38oSwKUayXBTY/vVeSLls90giUAOjswoRbBBQZvKyfEuFpc1zUsrhGLDC\n/6DuRt9l0DWcMcmP6Yh3jePIIwTr3bpxBGrwNLly8fPf16q4bWRIAcI3ZgLOhsrN\nLfD2kf56oYViM44d54Wa0qjuCfeTnJ46x/lo6w2kB9IzF7lwpipMU7+AG8ijDdaQ\nn8t0nADpv6tNNargLcOTTfJ0/P2PaKxwA1B88NhjlymBnNbz4epIn4T3KyysgS62\nzwqs66LPWoDerzc=\n-----END CERTIFICATE-----", "CertificateType": "PEM", "CertificateUri": { "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1" } } Change-Id: I2acbf8afa06bbf7d029d4971f7ab3b3988f5f060 Signed-off-by: Marri Devender Rao <devenrao@in.ibm.com> Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Add security headers to websocketsEd Tanous2019-05-291-4/+15
| | | | | | | | | | | | | | | | | | | | | | | | websocket connections are by definition temporal, and cannot be cached. Unfortunately, certain security scanners don't see it that way, and flag errors on lack of CSP, XSS, and Content-Type headers when giving a websocket upgrade response. This commit adds the: Strict-Transport-Security Pragma Cache-Control Content-security-policy X-XSS-Protection X-Content-Type-Options Headers to the response when an upgrade occurs, to make the security scanners happy. Tested: Opened the main application, obseved the /subscribe api. Signed-off-by: Ed Tanous <ed.tanous@intel.com> Change-Id: If76dc54f6501b3eb2caf44913d254a8b32d3fd30
* bmcweb: /s/boost::beast::string_view/std::string_view/gAdriana Kobylak2019-05-021-29/+29
| | | | | | | | | | Follow-on to https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/18891 Tested: Checked that the host console and virtual media endpoints still worked as expected. Change-Id: Ifdc5f21f3668bdf9bd24189504aaeb17b232c921 Signed-off-by: Adriana Kobylak <anoo@us.ibm.com>
* crow: websocket: Increase input buffer sizeAdriana Kobylak2019-04-241-1/+1
| | | | | | | | | | Increase the websocket input buffer size to support virtual media. The max network block device buffer size is 128kb plus 16bytes for the message header: https://github.com/NetworkBlockDevice/nbd/blob/master/doc/proto.md#simple-reply-message Change-Id: I6d6a95855f8c86f795532b8294d6189f3b766ece Signed-off-by: Adriana Kobylak <anoo@us.ibm.com>
* Redfish: Local variable overriding member variableMarri Devender Rao2019-04-081-4/+4
| | | | | | | | | | | timer handler local variable defined in run() method is overriding handler member variable. Tested: 1) Verified BMC web is running and able to process requests Change-Id: I6cd80dff16f3a932d8ada4fcf00917488e8ea936 Signed-off-by: Marri Devender Rao <devenrao@in.ibm.com>
* Add link for "Uri" objectsJason M. Bills2019-04-051-0/+4
| | | | | | | | | | | | | Message Registry File resources contain a "Uri" pointing to the location of the Message Registry. This change makes the "Uri" object a link that can be clicked to jump to the Message Registry. Tested: Verified that the "Uri" field is a link and takes you to the Message Registry. Change-Id: I33a443cffa7ed2f4c92f4a572d7186ef45be17f3 Signed-off-by: Jason M. Bills <jason.m.bills@linux.intel.com>
* Initial redfish logging supportAndrew Geissler2019-04-041-1/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This was imported from a fork: https://github.com/ampere-openbmc/bmcweb/commits/ampere-next/redfish-core/lib/logservices.hpp Which had a series of commits from TungVuX and hyche The initial patch is that code verbatim. Follow up patches on top of this make the necessary changes for current bmcweb: - Move to sdbusplus - C++ naming convention changes - Clang format - Some refactoring Tested: Verified new services work correctly when queried e.g. curl -k -H "X-Auth-Token: $bmc_token" -X GET \ https://${bmc}/redfish/v1/Systems/system/LogServices/EventLog/Entries displays the entries properly. RedfishServiceValidator results: /redfish/v1/Systems/system/LogServices pass: 3 passGet: 1 skipOptional: 1 /redfish/v1/Systems/system/LogServices/EventLog pass: 5 passGet: 1 skipOptional: 8 /redfish/v1/Systems/system/LogServices/EventLog/Entries pass: 3 passGet: 1 skipOptional: 1 /redfish/v1/Systems/system/LogServices/EventLog/<str> pass: 6 passGet: 1 skipOptional: 16 Sample Output: curl -k -H "X-Auth-Token: $bmc_token" -X GET https://${bmc}/redfish/v1/Systems/system/LogServices/EventLog/Entries { "@odata.context": "/redfish/v1/$metadata#LogEntryCollection.LogEntryCollection", "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries", "@odata.type": "#LogEntryCollection.LogEntryCollection", "Description": "Collection of System Event Log Entries", "Members": [ { "@odata.context": "/redfish/v1/$metadata#LogEntry.LogEntry", "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/1", "@odata.type": "#LogEntry.v1_4_0.LogEntry", "Created": "2019-02-22T17:11:00+00:00", "EntryType": "Event", "Id": "1", "Message": "example.xyz.openbmc_project.Example.Elog.AutoTestSimple", "Name": "System DBus Event Log Entry", "Severity": "Critical" } ], "Members@odata.count": 1, "Name": "System Event Log Entries" } Change-Id: I422b0d0ec577ea734fecfb6f49101ec5ff45a556 Signed-off-by: Andrew Geissler <geissonator@yahoo.com> Signed-off-by: Anthony Wilson <wilsonan@us.ibm.com>
* bmcweb: return 405 when a method is not supportedEd Tanous2019-04-011-0/+12
| | | | | | | | | | | | | | | | bmcweb previously took the crow approach to return codes, returning 200 for many things that didn't provide a VERB definition in its declaration. This patch corrects bmcweb to return an appropriate error code when the verb isn't supported. Tested: Ran test case here: https://github.com/openbmc/bmcweb/issues/69 Observed 405 returned instead of 200. Change-Id: I4c0fb5e68d6163ba6ff30faf1af403015888d475 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* bmcweb: avoid move in error conditionsEd Tanous2019-04-013-36/+19
| | | | | | | | | Moving a response container is a bit non-sensical, and a little wasteful when we're handling errors. This commit moves to simply handling it explicitly using the existing structures. Change-Id: Idacf633741363945b57194730bd7c3427a23b38d Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Allow multiple registrationsTanous2019-04-012-77/+177
| | | | | | | | | | | | | This patchset is the beginings of the infrastructure to allow separate registrations, and map privileges to the actual node in the url table rather than having each registration manage privileges manually. Tested by: Running redfish compliance tool. All things still pass. Change-Id: I72d278cc19c60ba5b6e563fbd705b0551faf9a6a Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* update ASIO interfacesEd Tanous2019-03-293-47/+97
| | | | | | | | | | | | This commit does 2 things. 1. Upgrades and prepares bmcweb for boost 1.70. 2. Allows us to compile with BOOST_AIO_NO_DEPRECATED Tested: Compiled against 1.69 and 1.70. All changes should be no-op. Change-Id: I557ecd840fe2b88c0fa01978a1b666b40ccccca4 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Revert "bmcweb: Fix a bunch of warnings"Ed Tanous2019-03-258-121/+98
| | | | | | | | This reverts commit 6ea007a2faec52ad62680015d2a3f00371a1e351. Reason for revert: Reports of bmcweb seg faults. Change-Id: I408f1bb29c2f8e427a6621cdaac8c31b847ebf06
* bmcweb: Fix a bunch of warningsEd Tanous2019-03-228-98/+121
| | | | | | | | | | | | bmcweb classically has not taken a strong opinion on warnings. With this commit, that policy is changing, and bmcweb will invoke the best warnings we are able to enable, and turn on -Werror for all builds. This is intended to reduce the likelihood of hard-to-debug situations that the compiler coulve caught early on. Change-Id: I57474410821e82666b3a108cfd0db7d070e8900a Signed-off-by: Ed Tanous <ed@tanous.net>
* bmcweb: /s/boost::string_view/std::string_view/gEd Tanous2019-03-066-17/+16
| | | | | | | | | | | | | | | | | | | | | | | With boost 1.69, we get the new option, BOOST_BEAST_USE_STD_STRING_VIEW which allows us to use std::string for all beast interfaces, instead of boost string_view. This was originally intended to try to reduce the binary size, but the comparison shows only a minor improvement. boost::string_view: 7420780 bytes std::string_view: 7419948 bytes 832 bytes saved ! ! ! ! ! So instead, we will use the argument that it's more standard and easier for people to grok. Tested By: Pulled down some bmcweb endpoints, and observed no change. Because the two objects are essentially drop in replacements for one another, there should be no change. Change-Id: I001e8cf2a0124de4792a7154bf246e3c35ef3f97 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* bmcweb: update TLS cipher suites to mozilla modernEd Tanous2019-02-221-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the second attempt to make cipher suites more restrictive. This was previously attempted in patchset 54fd221a9139f46c7c95b4a22cc09e6e7ce4cbbc Which caused some compatibility issues. This is the second attempt, which does a better job. OWASP does not enable eppiliptic curve TLS 1.2 cipher suites, which at this time are required for bmcweb to function. Previously, bmcweb was utilitizing the "mozilla compatibility" cipher suites. This is overly lenient on broken ciphers and can cause some issues with security reviews. This commit also fixes our TLS logic to support _only_ TLS 1.2 and 1.3, as only updating the cipher suites caused us to fall into TLS 1.3 only, which broke compatibility with a lot of operating systems. Tested by: Ran the testssl.sh script here: https://github.com/drwetter/testssl.sh Observed the following in the output: testssl.sh 3.0rc3 from https://testssl.sh/dev/ (977dc1ac4 2019-02-06 22:42:14 -- ) This program is free software. Distribution and modification under GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK! Please file bugs @ https://testssl.sh/bugs/ Using "OpenSSL 1.0.2-chacha (1.0.2k-dev)" [~183 ciphers] on Hades:/home/ed/testssl.sh/bin/openssl.Linux.x86_64 (built: "Jan 18 17:12:17 2019", platform: "linux-x86_64") Start 2019-02-08 11:04:50 -->> 10.243.49.64:18080 (10.243.49.64) <<-- rDNS (10.243.49.64): wolfpass.jf.intel.com. Service detected: HTTP Testing protocols via sockets except NPN+ALPN SSLv2 not offered (OK) SSLv3 not offered (OK) TLS 1 not offered TLS 1.1 not offered TLS 1.2 offered (OK) TLS 1.3 offered (OK): final NPN/SPDY not offered ALPN/HTTP2 not offered Testing cipher categories NULL ciphers (no encryption) not offered (OK) Anonymous NULL Ciphers (no authentication) not offered (OK) Export ciphers (w/o ADH+NULL) not offered (OK) LOW: 64 Bit + DES, RC[2,4] (w/o export) not offered (OK) Triple DES Ciphers not offered (OK) 128 Bit ciphers (SEED, IDEA, 128 Bit CBC) offered High encryption (AES/Aria/Camellia, !AEAD) offered (OK) Strong encryption (AEAD ciphers) offered (OK) Testing robust (perfect) forward secrecy, (P)FS -- omitting Null Authentication/Encryption, 3DES, RC4 PFS is offered (OK) TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA256 Elliptic curves offered: prime256v1 secp384r1 secp521r1 X25519 X448 Testing server preferences Has server cipher order? yes (OK) -- only for < TLS 1.3 Negotiated protocol TLSv1.3 Negotiated cipher TLS_AES_256_GCM_SHA384, 253 bit ECDH (X25519) Cipher order TLSv1.2: ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA256 TLSv1.3: TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 Testing server defaults (Server Hello) TLS extensions (standard) "renegotiation info/#65281" "EC point formats/#11" "session ticket/#35" "supported versions/#43" "key share/#51" "supported_groups/#10" "max fragment length/#1" "encrypt-then-mac/#22" "extended master secret/#23" Session Ticket RFC 5077 hint 7200 seconds, session tickets keys seems to be rotated < daily SSL Session ID support yes Session Resumption Tickets: yes, ID: no TLS clock skew Random values, no fingerprinting possible Signature Algorithm ECDSA with SHA256 Server key size EC 256 bits Server key usage -- Server extended key usage -- Serial / Fingerprints 669B86F0 / SHA1 0F6BF7C8F1AB59767FCA372A88F7F5457CFE00FB SHA256 1D8C3AC5BA670C8C4EE8F5A76C8597226D89744510A4998B1A7888EF566256E5 Common Name (CN) testhost subjectAltName (SAN) missing (NOT ok) -- Browsers are complaining Issuer self-signed (NOT ok) Trust (hostname) certificate does not match supplied URI Chain of trust NOT ok (self signed) EV cert (experimental) no "eTLS" (visibility info) not present Certificate Validity (UTC) 3648 >= 60 days (2019-02-07 10:23 --> 2029-02-04 10:23) # of certificates provided 1 Certificate Revocation List -- OCSP URI -- NOT ok -- neither CRL nor OCSP URI provided OCSP stapling not offered OCSP must staple extension -- DNS CAA RR (experimental) not offered Certificate Transparency -- Testing HTTP header response @ "/" HTTP Status Code 200 OK HTTP clock skew -83092 sec from localtime Strict Transport Security 365 days=31536000 s, includeSubDomains, preload Public Key Pinning -- Server banner iBMC Application banner -- Cookie(s) (none issued at "/") Security headers X-Frame-Options DENY X-XSS-Protection 1; mode=block X-Content-Type-Options nosniff Content-Security-Policy default-src 'self' X-UA-Compatible IE=11 Reverse Proxy banner -- Testing vulnerabilities Heartbleed (CVE-2014-0160) not vulnerable (OK), no heartbeat extension CCS (CVE-2014-0224) not vulnerable (OK) Ticketbleed (CVE-2016-9244), experiment. not vulnerable (OK), reply empty ROBOT Server does not support any cipher suites that use RSA key transport Secure Renegotiation (CVE-2009-3555) not vulnerable (OK) Secure Client-Initiated Renegotiation VULNERABLE (NOT ok), DoS threat CRIME, TLS (CVE-2012-4929) not vulnerable (OK) BREACH (CVE-2013-3587) potentially NOT ok, uses gzip HTTP compression. - only supplied "/" tested Can be ignored for static pages or if no secrets in the page POODLE, SSL (CVE-2014-3566) not vulnerable (OK) TLS_FALLBACK_SCSV (RFC 7507) No fallback possible, no protocol below TLS 1.2 offered (OK) SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) FREAK (CVE-2015-0204) not vulnerable (OK) DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) no RSA certificate, thus certificate can't be used with SSLv2 elsewhere LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 BEAST (CVE-2011-3389) no SSL3 or TLS1 (OK) LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses cipher block chaining (CBC) ciphers with TLS. Check patches RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) Testing 370 ciphers via OpenSSL plus sockets against the server, ordered by encryption strength Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC) ----------------------------------------------------------------------------------------------------------------------------- x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256 xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH 521 AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 xc024 ECDHE-ECDSA-AES256-SHA384 ECDH 521 AES 256 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH 521 ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256 xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH 521 AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 xc023 ECDHE-ECDSA-AES128-SHA256 ECDH 521 AES 128 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 Running client simulations (HTTP) via sockets Android 4.2.2 No connection Android 4.4.2 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 521 bit ECDH (P-521) Android 5.0.0 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256, 521 bit ECDH (P-521) Android 6.0 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256, 256 bit ECDH (P-256) Android 7.0 TLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305, 253 bit ECDH (X25519) Chrome 65 Win 7 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256, 253 bit ECDH (X25519) Chrome 70 Win 10 TLSv1.3 TLS_AES_128_GCM_SHA256, 253 bit ECDH (X25519) Firefox 59 Win 7 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256, 253 bit ECDH (X25519) Firefox 62 Win 7 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256, 253 bit ECDH (X25519) IE 6 XP No connection IE 7 Vista No connection IE 8 Win 7 No connection IE 8 XP No connection IE 11 Win 7 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 256 bit ECDH (P-256) IE 11 Win 8.1 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 256 bit ECDH (P-256) IE 11 Win Phone 8.1 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256, 256 bit ECDH (P-256) IE 11 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 256 bit ECDH (P-256) Edge 13 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 256 bit ECDH (P-256) Edge 13 Win Phone 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 256 bit ECDH (P-256) Edge 15 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 253 bit ECDH (X25519) Opera 17 Win 7 TLSv1.2 ECDHE-ECDSA-AES128-SHA256, 256 bit ECDH (P-256) Safari 9 iOS 9 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 256 bit ECDH (P-256) Safari 9 OS X 10.11 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 256 bit ECDH (P-256) Safari 10 OS X 10.12 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 256 bit ECDH (P-256) Apple ATS 9 iOS 9 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 256 bit ECDH (P-256) Tor 17.0.9 Win 7 No connection Java 6u45 No connection Java 7u25 No connection Java 8u161 TLSv1.2 ECDHE-ECDSA-AES256-SHA384, 256 bit ECDH (P-256) Java 9.0.4 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 256 bit ECDH (P-256) OpenSSL 1.0.1l TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 521 bit ECDH (P-521) OpenSSL 1.0.2e TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 256 bit ECDH (P-256) Done 2019-02-08 11:06:45 [ 118s] -->> 10.243.49.64:18080 (10.243.49.64) <<-- Change-Id: I92a77807848354379ea2cbaa31767eeceadae295 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* bmcweb: fix compiler warningsEd Tanous2019-02-215-13/+11
| | | | | | | | | | | | This patchset attempts to fix all compiler warnings in bmcweb owned files. There are 2 warnings left, both in sdbusplus, which will be resolved in a patchset there. Tested By: Recompiled, observed warning count went from 30, to zero. Change-Id: Ife90207aa5773bc28faa8b04c732cafa5a56e4e4 Signed-off-by: Ed Tanous <ed@tanous.net>
* bmcweb: Resolve build error with non-SSL buildsEd Tanous2019-02-202-9/+4
| | | | | | | | | | Resolves #40 Tested by: Built with BMCWEB_INSECURE_DISABLE_SSL. Build suceeded. Change-Id: I3641e18b097d54c21720728ec72999e963e668a3 Signed-off-by: Ed Tanous <ed@tanous.net>
* Delete socket adaptersEd Tanous2019-02-048-293/+129
| | | | | | | | | | | | | | Boost beast, ASIO, and networking TS already have mechanisms for injecting unit tests, using template parameters. We already use this to some extent, although we pass through socket_adapters. Now that we have constexpr if, we have the ability to simplify this code quite a bit. Tested by: Pulled down phosphor-webui, ran redfish service validator. Observed no errors. Change-Id: Ib8734aeb4c9139b56705060f6196e8ae16458fe9 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* bmcweb: Remove deprecatd ASIO interfacesEd Tanous2019-01-126-25/+25
| | | | | | | | | | | boost::asio::io_service is removed in leiu of io_context, which is a closer match to the networking TS. Move us to that implementatio. This was an automated move using the following command: git grep -l 'io_service' | xargs sed -i 's/io_service/io_context/g' Change-Id: I46605521c01f79f86f6901ddf69ddc8c4bc24103 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* bmcweb: Resolve issue with MIME type on redfishEd Tanous2019-01-031-0/+1
| | | | | | | | | The Redfish UI isn't presented properly with the latest security changes because the MIME type wasn't explicitly set. This resolves it, by adding an MIME type to redfish. Change-Id: Ic1b0c0bd6fb2b8b6b4d9393127e3e606ad7cb655 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* bmcweb: Fix inversion of SSLEd Tanous2018-12-101-2/+2
| | | | | | | | | | Somehow, in a patchset merge, SSL got inverted with not SSL, so SSL mode enabled an SSL socket, and non SSL mode enabled an SSL socket. THis should resolve it. Change-Id: Ia3ebc0bf6ce341a66756dc192d66894b2e9121a7 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* bmcweb: Move boost::optional to std::optionalEd Tanous2018-12-102-5/+5
| | | | | | | | This change is largely a sed replace, and gets us closer to standards compliance. Change-Id: Ie60437eff43de830ef19389344a55430dabd9d16 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* bmcweb: make SSL enabling more effectiveEd Tanous2018-12-101-34/+37
| | | | | | | | | | | | When specializing code, we know at compile time whether or not SSL will be used, so we don't need to instantiate both types of socket/server/app, when we only really care about one at runtime. The size savings here aren't huge, but are worth doing, just for compile times. Change-Id: If4e9934a72eb0f12ce3755c6350e91b8ba485af1 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* bmcweb: Fix header includes to be more specificEd Tanous2018-12-043-9/+11
| | | | | | | | | | | | | In a lot of cases, the header include patterns were really bad. For example, pulling in all of boost asio via boost/asio.hpp, rather than pulling in the lesser equivalents. This should reduce the build times, although I have no data on that at the moment. Tested By: Code still compiles Change-Id: I0f4656d35cf6d7722d1b515baaccbfc27cf98961 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* bmcweb: Move some functions to utilitiesEd Tanous2018-12-042-48/+49
| | | | | | | These functions should've always been in utilities, so move them there. Change-Id: I9c0bfa875cdc02253e8aa95978ddaa8fd6671b5e Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* crow: work around gcc bug 87513Brad Bishop2018-11-301-3/+1
| | | | | | | | | | | | | | | | In file included from src/webserver_main.cpp:1: | crow/include/crow/app.h: In instantiation of ...blah blah blah | src/webserver_main.cpp:110:1: required from here | crow/include/crow/app.h:61:10: internal compiler error: in write_expression, at cp/mangle.c:3050 | auto route(std::string&& rule) -> typename std::result_of< | ^~~~~ | Please submit a full bug report, We lose c++11 compatibility. ¯\_(ツ)_/¯ Change-Id: Ie30805a88355be0c7adb7b70234989a16b4f1b45 Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
* Remove HTTPMethod EnumEd Tanous2018-11-261-24/+0
| | | | | | | | | With the transition to beast, all uses of this enum have moved to the boost::beast::http::verb, and this enum is no longer neccesary. It can be removed. Change-Id: I6065b8159ec8a9ffdae6f98063798e12956c18d6 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Add paging and partial results for BMCLogServiceJason M. Bills2018-10-291-2/+7
| | | | | | | | | | | | | | | | | | Since BMC logs can be very large and may take some time to load, the browser could time out during the request. This change adds partial results support for those logs using the $skip and $top redfish query parameters so only up to 1000 are printed at a time with a link to get the next 1000 if they exist. Tested: Loaded a log with more than 1000 entries and confirmed that $skip entries are skipped and only $top (up to 1000) are loaded. Also verified that the nextLink property correctly points to the next set of log entries. Change-Id: I0a586524a8aab47b9ab457e1d3f56a8b6d97a700 Signed-off-by: Jason M. Bills <jason.m.bills@linux.intel.com>
* Fix URL query parameter parsingJason M. Bills2018-10-192-2/+2
| | | | | | | | | | | | This change makes some minor corrections requried to properly parse query parameters in the url. Tested: Checked that parsing is working properly by using redfish $skip and $top parameters and values and confirming the values are correctly available in redfish. Change-Id: If95838cf0d4a1044059d3ca2630c8e3640b1f558 Signed-off-by: Jason M. Bills <jason.m.bills@linux.intel.com>
* Fix buffer bug in websocketsEd Tanous2018-10-081-11/+11
| | | | | | | | | | The websocket implementation had a buffer bug where buffers would duplicate the input data. This commit fixes the buffering issues, by backing the buffer with a simple std::string rather than a fixed buffer, and properly consuming it. Change-Id: If7407250d667b6b21cb0fa8699e0e396a2178203 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Move to clang-format-6.0Ed Tanous2018-09-0515-3021/+3728
| | | | | | | | This commit moves the codebase to the lastest clang-format file from upstream, as well as clang-format-6.0. Change-Id: Ice8313468097c0c42317fbb9e10ddf036e8cff4c Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Last round of variable renamesEd Tanous2018-08-151-9/+9
| | | | | | | | A few patches were in flight when we did the great variable renaming. This catches all the patches that have been merged since Change-Id: Ie9642a4812b2a679ffa01ce540f5c4515a4c710b Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Disable threadingEd Tanous2018-08-151-1/+0
| | | | | | | | | | | | | This commit disables threads from bmcweb. They weren't really used, but bmcweb linked against pthread regardless because of history. This commit, while small, makes some pretty important changes. 1. libstdc++ shared_ptr now becomes cheaper to increment and decrement ref counts, as it knows that we only have a single thread. 2. We save about 8k on our compiled size, most likely due to optimizations the compiler can do around threading assumptions. Change-Id: Ib9c20aaa2489952728de2ba8b93b24532e7b8c18 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Implement POST for redfish UpdateServiceJennifer Lee2018-08-151-2/+9
| | | | | | | | | | | | - POST an image file to /redfish/v1/UpdateServer uri will upload the image and activate it - Modified SoftwareInventoryCollection to list items with xyz.openbmc_project.Software.Activation/Activation property as "xyz.openbmc_project.Software.Activation.Activations.Active" - SoftwareInventory odata.id is identified with DBus generated uuid Signed-off-by: Jennifer Lee <jennifer1.lee@intel.com> Change-Id: I48c3e6d868d1c27420cab5a706e4205f06713923
* Fix merge conflictEd Tanous2018-08-091-5/+3
| | | | | | | | | Got a couple patches that collided in air, and now builds are broken. This resolves the collision by moving the new patches forward to the latest #defines Change-Id: I1fe35d17a68c61ad90752ae73000e2579131bf5d Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Move websocket implementation to boost beastEd Tanous2018-08-074-393/+133
| | | | | | | | | | | Boost beast is already in much better use, and gives more confidence in the security model. This change keeps the existing crow interfaces, and simply replaces the backend with beast. Calling code remains largely unchanged, with the exception of having to explicitly cast to string (to obtain a string view) when sending messages. Change-Id: I90edad505faf2d4465b4888f1f2c4b12cc9e77d0 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Move over to upstream c++ styleEd Tanous2018-07-2616-1417/+1408
| | | | | | | | | | | | | | | | | | This patchset moves bmcweb over to the upstream style naming conventions for variables, classes, and functions, as well as imposes the latest clang-format file. This changeset was mostly built automatically by the included .clang-tidy file, which has the ability to autoformat and auto rename variables. At some point in the future I would like to see this in greater use, but for now, we will impose it on bmcweb, and see how it goes. Tested: Code still compiles, and appears to run, although other issues are possible and likely. Change-Id: If422a2e36df924e897736b3feffa89f411d9dac1 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Implement debug logging for responsesEd Tanous2018-07-261-6/+11
| | | | | | | | | | In production code, we should never call end() on a response twice. In practice there are a lot of cases where this happens, and while it's handled gracefully, it's incorrect. This adds error logging for this case. Change-Id: Iffb1dd26bfc656e9ca8cf1f179b90e501f3da949 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Avoid an extra move when returning 404Ed Tanous2018-07-261-1/+1
| | | | | | | | In this case, we can simply handle the response cases in place, rather than moving from a newly constructed object. Change-Id: I95c7a4f3e302700a750f9c0f575b88ae4150fa15 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Implement feature selection in bmcwebEd Tanous2018-06-296-141/+117
| | | | | | | | | This patchsets implements feature selection in BMCWEB using compile time macros. This allows certain features, security implementations, and other things to be selected at compile time. Change-Id: Ic14343d36d82830e6cf51311ca886a90749ae6a7 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Fix issue with basic auth and the bmcwebEd Tanous2018-06-291-18/+2
| | | | | | | | | This fixes a bug where the webserver requests a resource that doesn't exist, which triggers a www-authenticate, and causes the browser to show the wrong thing. Change-Id: I65643a50eb269b0a7c76dcb0c65c4e7db2165c88 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Boost beastEd Tanous2018-06-2922-5558/+455
| | | | | | | | This commit is the beginings of attempting to transition away from crow, and toward boost::beast. Unit tests are passing, and implementation appears to be slightly faster than crow. Change-Id: Ic8d946dc7a04f514c67b1098f181eee1ced69171
OpenPOWER on IntegriCloud