summaryrefslogtreecommitdiffstats
path: root/redfish-core/include/node.hpp
Commit message (Collapse)AuthorAgeFilesLines
* Fix authorization for LDAP usersRAJESWARAN THILLAIGOVINDAN2019-12-171-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Modified the code to make an asynchronous call to GetUserInfo to get the user role for authorization. For local users, DBus matches are used to store user role map hot in memory. Hence, bmcweb has to know whether a user is a local user or LDAP user to get the role. To avoid this, removed the existing DBus matches and modified the code to call GetUserInfo to get the role of local users as well as LDAP users. Tested: - Created a local user having admin privilege and verified that he is able to restart the system /redfish/v1/Systems/system/Actions/ComputerSystem.Reset -d '{"ResetType": "GracefulRestart"}' - Created a local user having user privilege and verified that he is unauthorized to restart the system /redfish/v1/Systems/system/Actions/ComputerSystem.Reset -d '{"ResetType": "GracefulRestart"}' - Created a remote user having admin privilege and verified that he is able to restart the system /redfish/v1/Systems/system/Actions/ComputerSystem.Reset -d '{"ResetType": "GracefulRestart"}' - Created a remote user having user privilege and verified that he is unauthorized to restart the system /redfish/v1/Systems/system/Actions/ComputerSystem.Reset -d '{"ResetType": "GracefulRestart"}' - Tested Redfish ConfigureSelf privilege Signed-off-by: RAJESWARAN THILLAIGOVINDAN <rajeswgo@in.ibm.com> Change-Id: Ic3e46a0c0aff2cf456c98048350e58e302011c57
* bmcweb: Handle ConfigureSelf privilegeJoseph Reynolds2019-12-061-0/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Enhances BMCWeb to correctly handle the Redfish ConfigureSelf privilege. Redfish document DSP2046 defines the ConfigureSelf privilege as "Can change the password for the current user account and log out of their own sessions." This notion is formalized in the Redfish DSP8011 PrivilegeRegistry where ConfigureSelf appears in three operations: - ManagerAccount (/redfish/v1/AccountService/Accounts/{account}) GET operation. - ManagerAccount (/redfish/v1/AccountService/Accounts/{account}) PATCH Password property override. - Session (/redfish/v1/SessionService/Sessions/{sessionid}) DELETE operation. Tested: Yes, tested the above operations using users with various Roles to determine which operations are allowed. ReadOnly users (privileges: Login, ConfigureSelf): - Can GET their own account. - Can change their password. - Can log out. - Cannot change any other properties of their own account. - Cannot change anyone else's password. - Cannot GET someone else's account. - Cannot log out anyone else. Operator users (privileges: Login, ConfigureComponents, ConfigureSelf): - Same access as a ReadOnly user. Administrator users (all privileges): - Can do everything Operator can do. - Can change one or more properties of their account - Can GET and change properties of someone else's account. - Can logoff any session. Signed-off-by: Joseph Reynolds <joseph-reynolds@charter.net> Change-Id: If8efd71cb9743a59b7c5fe1565804d21e788ea29
* Make references to crow less obviousEd Tanous2019-10-181-2/+2
| | | | | | | | | | | | | | | | | Recently, a number of people in the community have made the (admittedly easy) mistake that we use a significant portion of crow. Today, we use crow for the router, and the "app" structure, and even those have been significantly modified to meet the bmc needs. All other components have been replaced with Boost beast. This commit removes the crow mentions from the Readme, and moves the crow folder to "http" to camouflage it a little. No code content has changed. Tested: Code compiles. No functional change made to any executable code. Signed-off-by: Ed Tanous <ed.tanous@intel.com> Change-Id: Iceb57b26306cc8bdcfc77f3874246338864fd118
* Fix a bunch of warningsEd Tanous2019-10-101-1/+1
| | | | | | | | | | | | | | | using the list of warnings from here: https://github.com/lefticus/cppbestpractices/blob/e73393f25a85f83fed7399d8b65cb117d00b2231/02-Use_the_Tools_Available.md#L100 Seems like a good place to start, and would improve things a bit type-wise. This patchset attempts to correct all the issues in one shot. Tested: It builds. Will test various subsystems that have been touched Signed-off-by: Ed Tanous <ed.tanous@intel.com> Change-Id: I588c26440e5a97f718a0f0ea74cc84107d53aa1e
* Allow multiple registrationsTanous2019-04-011-49/+76
| | | | | | | | | | | | | This patchset is the beginings of the infrastructure to allow separate registrations, and map privileges to the actual node in the url table rather than having each registration manage privileges manually. Tested by: Running redfish compliance tool. All things still pass. Change-Id: I72d278cc19c60ba5b6e563fbd705b0551faf9a6a Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Move some include headers to a less specific folderEd Tanous2019-03-061-1/+3
| | | | | | | Tested by: Code still compiles Change-Id: I95d443f5c21e9839b6338fb72c5a940d0d91d479
* bmcweb: Redfish away from json cacheEd Tanous2018-11-261-65/+0
| | | | | | | | | | | | | | | | | | | | In the original incarnation of bmcweb, route registration was done automatically. This has proved to be a terrible idea, wraught with corner cases and issues. The route registration is currently the only user of the redfish::Node::json element. Unfortunately, as written, this structure consumes a lot of memory that's duplicated and not very useful. From a performance perspective, there is almost no difference between rebuilding the structure for each GET request, and having the "cache" that needs to be copied into the response and modified before it can be useful. In the programming tradeoffs for bmc, lower memory usage is more important than latency, especially at these levels. Change-Id: I785e8352123e5e886acf05cd59cb23648f93839d Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Improve the Redfish error reporting interfaceJason M. Bills2018-10-221-17/+0
| | | | | | | | | | | Makes the Redfish error reporting interface automatically handle setting the http status and JSON content in the response object. When using an AsyncResp object, this allows for simply calling the Redfish error and returning. Change-Id: Icfdce2de763225f070e8dd61e591f296703f46bb Signed-off-by: Jason M. Bills <jason.m.bills@linux.intel.com>
* Generalize the "Async Response" patternEd Tanous2018-09-121-0/+19
| | | | | | | | | | Lots of endpoints have been using the AsyncResp structure, and some, like the systems schemas, have created their own. This is the start of a series of patches to move to a more condensed async response object. Tested by: ran GET on systems schema and observed no change to behavior. Change-Id: I4c9afc583be3f75371b31cc76dcc02590ce5e9a7
* Move to clang-format-6.0Ed Tanous2018-09-051-124/+153
| | | | | | | | This commit moves the codebase to the lastest clang-format file from upstream, as well as clang-format-6.0. Change-Id: Ice8313468097c0c42317fbb9e10ddf036e8cff4c Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Clang-format cleanupEd Tanous2018-08-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | It looks like some of the code reviews in progress contain clang-format fixes as well. This squashes all of the clang-format fixes into a single commit, that hopefully can go through the process a little faster, as it should only be whitespace changes. In the past, clang-formatting the naughty strings file proved to return inconsistent results, and even formatted files would still be detected as unformatted. Aparently the solution was to run clang-format-5.0 approximately 20 times in a loop, until it decided on a code layout that it was ok with iteration to iteration. This is a bit of a corner case, so I don't think we need to get CI running multiple runs in the future, and can just handle this on a case by case basis. I'd be surprised if anyone else had this issue. Change-Id: I57e2a03676bce20dc376fd9cea724732b2dc7010 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Move over to upstream c++ styleEd Tanous2018-07-261-15/+15
| | | | | | | | | | | | | | | | | | This patchset moves bmcweb over to the upstream style naming conventions for variables, classes, and functions, as well as imposes the latest clang-format file. This changeset was mostly built automatically by the included .clang-tidy file, which has the ability to autoformat and auto rename variables. At some point in the future I would like to see this in greater use, but for now, we will impose it on bmcweb, and see how it goes. Tested: Code still compiles, and appears to run, although other issues are possible and likely. Change-Id: If422a2e36df924e897736b3feffa89f411d9dac1 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Make doGet implementations optionalEd Tanous2018-07-261-1/+4
| | | | | | | | | There are cases in redfish where one may want to support ONLY a POST/PATCH interface, and not support GET. This patchset provides default behavior for that case. Change-Id: Ibd46c5dda2af543c491c1d6fba3d0adb65699db2 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Remove some critical debug printsEd Tanous2018-07-241-2/+2
| | | | | | | | | These prints are causing a lot of excess logs, and for the current archittecture, the error isn't a concern. This could use some cleanup in the future, but for now, comment out so we get more useful logs. Change-Id: I3113f985745e5c0286e25abbd7ccdef3a3094269 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Implemented PATCH for EthernetInterface VLAN and HostName fieldsKowalski, Kamil2018-06-291-0/+13
| | | | | | | | | | | | Implemented PATCH request handling in EthernetInterface schema. Currently only VLAN and HostName patching is implemented - IP changes will be introduced in further patchsets. This code does not change existing functionality - only expands it. Tested on real hardware and x86 VM. Works fine, passes RedfishSchemaValidator. Change-Id: I8de4ee5e859218823b07cc11845f7ef6782d7171 Signed-off-by: Kowalski, Kamil <kamil.kowalski@intel.com>
* Boost beastEd Tanous2018-06-291-7/+7
| | | | | | | | This commit is the beginings of attempting to transition away from crow, and toward boost::beast. Unit tests are passing, and implementation appears to be slightly faster than crow. Change-Id: Ic8d946dc7a04f514c67b1098f181eee1ced69171
* Enabling Ethernet Interfaces, and Ethernet Interfaces Collection SchemasRapkiewicz, Pawel2018-04-221-1/+1
| | | | | | | | | | | | | | | | | | | Commit provides Schemas for: * Single Eth Interface (GET) * Eth Interface Collection (GET) Both are using EthernetProvider, which delivers data available from xyz.openbmc_project.Network It was tested: * Regression (no regression in web server behaviour) * Memory Leaks (no leaks detected via valgrind) * Compiling multiple arch (x86, ASPEED) * Service Validator pass all available schemas Change-Id: Idee321cb294f48b59f7740512bbe416cf10236c0 Signed-off-by: Rapkiewicz, Pawel <pawel.rapkiewicz@intel.com> Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Make getUrl not copyEd Tanous2018-04-201-15/+24
| | | | | | | | | Make get url return a const std::string* instead of a copy. Also, make the getSubroutes function modify strings in place rather than construct new strings where possible Change-Id: I68d8053a62abd8d907ecb6717e0f266eee4d09a8 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Make a few changes to privileges commitEd Tanous2018-03-271-7/+5
| | | | | | | | | | | | | | | | | | | | | | 1. Create char* overloads for the things that need it. 2. Fix up a couple errant moves 3. Use the gtest APIs for testing container membership, rather than sort 4. Move the index management to vector rather than map to avoid a lookup 5. Remove errant use of .at() 6. Move privilege comparison into the privilege class, in order to keep the bitset implementation private. This removes the requirment on the forward declaration of PrivilegeProvider, and the use of friend class 7. Remove unimplemented override strcutures. Feel free to add them back once implemented 8. Make setSignlePrivilege return a code if the set failed 9. Remove the need for an extra construction of a blank privileges object for things that require no privileges. Tested by: updating unit tests with the appropriate APIs. Relevant unit tests pass Change-Id: Ie9cde003b6c865979b4cac086379d0a3473896ce Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Improved Refish subroutesBorawski.Lukasz2018-03-271-22/+47
| | | | | | | | | | - getSubroutes() is now a method of the Node class - getSubroutes() is called only once per node at construction time, not at each GET request - template parameter removed from the Node class Change-Id: Ie4eb8766717aae566c13c295458fe0dba8ab84c0 Signed-off-by: Borawski.Lukasz <lukasz.borawski@intel.com>
* Privilege implementation changeBorawski.Lukasz2018-03-271-6/+4
| | | | | | | | | | - privilege_registry.json has been removed - PrivilegeProvider class has been removed - default privileges for nodes are now hard-coded - privilege overriding feature is not yet implemented Change-Id: Ic9fdfa1c692c1abd26e339e2a8c702fc4aebd19f Signed-off-by: Borawski.Lukasz <lukasz.borawski@intel.com>
* Redfish privilegesBorawski.Lukasz2018-03-271-36/+35
| | | | | | | | | | | | Redfish privilege authorization subsystem controlled by the privilege_registy.json configuration file. PropertyOverrides, SubordinateOverrides and ResourceURIOverrides are not yet implemented. Change-Id: I4d5670d557f4da172460ada3512e015830dab667 Signed-off-by: Borawski.Lukasz <lukasz.borawski@intel.com> Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Service RootBorawski.Lukasz2018-01-241-2/+20
| | | | | Change-Id: Ibf9d463802d77014852a92ecfcb8096324f3670f Signed-off-by: Borawski.Lukasz <lukasz.borawski@intel.com>
* Node abstraction layerBorawski.Lukasz2018-01-231-0/+115
Change-Id: I3cbad5b566cd005d33a9fbd18ff4e6669dae3a31 Signed-off-by: Borawski.Lukasz <lukasz.borawski@intel.com>
OpenPOWER on IntegriCloud