summaryrefslogtreecommitdiffstats
path: root/redfish-core/lib/service_root.hpp
Commit message (Collapse)AuthorAgeFilesLines
* Redfish: Add certificate service to manage HTTPS certificatesMarri Devender Rao2019-06-121-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implements CertificateService schema to list the actions available. Implements CertificateLocations schema to list the certificates present in the system. Implements CertificateCollection schema to upload/list existing HTTPS certificates Implements Certificate schema to view existing HTTPS certificate Cater for reloading the SSL context after a certificate is uploaded. Fix Certificate signature validation failure At present bmcweb uses the certificate from "/home/root/server.pem" the same is modified to "/etc/ssl/certs/https/server.pem" as phosphor-certificate-manager uses the specified path to install/replace certificates. Bmcweb creates a self-signed certificate when certificate is not present. Catered for creating "/etc/ssl/certs/https/" direcotry structure so that self signed certificate is created in the path. Implements ReplaceCertificate action of Certificate Service for replacing existing HTTPS certificates Cleanup of older self-signed certificate at /home/root/server.pem 1. Tested schema with validator and no issues 2. Privilege map for certificate service is not yet pubished 2. GET on /redfish/v1/CertificateService/ "CertificateService": { "@odata.id": "/redfish/v1/CertificateService" }, 3. GET on /redfish/v1/CertificateService/CertificateLocations/ "@odata.context": "/redfish/v1/$metadata#CertificateLocations.CertificateLocations", "@odata.id": "/redfish/v1/CertificateService/CertificateLocations", "@odata.type": "#CertificateLocations.v1_0_0.CertificateLocations", "Description": "Defines a resource that an administrator can use in order to locate all certificates installed on a given service", "Id": "CertificateLocations", "Name": "Certificate Locations" 4.POST on /redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates { Returns contents of certificate "@odata.context": "/redfish/v1/$metadata#Certificate.Certificate", "@odata.id": "/redfish/v1/AccountService/LDAP/Certificates/1", "@odata.type": "#Certificate.v1A_0_0.Certificate", "Id": "1", "Issuer": { ... ... } 5.GET on /redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/ { "@odata.context": "/redfish/v1/$metadata#CertificateCollection.CertificateCollection", "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates", "@odata.type": "#CertificateCollection.CertificatesCollection", "Description": "A Collection of HTTPS certificate instances", "Members": [ { "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1" } ], "Members@odata.count": 1, "Name": "HTTPS Certificate Collection" } 6.GET on /redfish/v1/CertificateService/CertificateLocations/ { "@odata.context": "/redfish/v1/$metadata#CertificateLocations.CertificateLocations", "@odata.id": "/redfish/v1/CertificateService/CertificateLocations", "@odata.type": "#CertificateLocations.v1_0_0.CertificateLocations", "Description": "Defines a resource that an administrator can use in order to locate all certificates installed on a given service", "Id": "CertificateLocations", "Links": { "Certificates": [ { "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1" } ], "Certificates@odata.count": 1 }, "Name": "Certificate Locations" } 7.GET on /redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1 { "@odata.context": "/redfish/v1/$metadata#Certificate.Certificate", "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1", "@odata.type": "#Certificate.v1_0_0.Certificate", "CertificateString": "-----BEGINCERTIFICATE-----\n....\n-----ENDCERTIFICATE-----\n", "CertificateType": "PEM", "Description": "HTTPS Certificate", "Id": "1", "Issuer": { } 8. Verified SSL context is reloaded after a certificate is installed. 9.curl -c cjar -b cjar -k -H "X-Auth-Token: $bmc_token" -X POST https://${bmc}/redfish/v1/CertificateService/Actions/CertificateService.ReplaceCertificate/ -d @data_https.json { "@odata.context": "/redfish/v1/$metadata#Certificate.Certificate", "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1", "@odata.type": "#Certificate.v1_0_0.Certificate", "CertificateString": "-----BEGIN CERTIFICATE----END CERTIFICATE-----\n", "Description": "HTTPS certificate", "Id": "1", "Issuer": { } 4. data_https.json file contents { "CertificateString": "-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDClW1COSab2O0W\nW0SgTzLxQ1Igl4EpbEmTK8CAQ+wI7loTDZ7sZwYdf6yc9TAs/yNKjlJljgedGszv\nbC7sPNpH4FA63kaM6TbBBKTRshwZ3myXiBOOkOBs6w6V7+c7uEPcMFge6/4W1VXD\nReMi016cnPWZsmQyGzpmPM49YNEDZBfdKZ/pLuCYc9L9t706U7FrUSGfM7swB+mC\n8NH9qMixMuWAV9SBvzUWI6p4OCmN8a/F+4lOdbPMVEUqQ0hCBCjGM4qmiy/5Ng6y\n6rKeJlUdmOSTk8ojrNGcOXKh0nRafNEQFkIuoPHt8k5B/Yw2CX6s2BoGwvF+hS03\n+z3qVSw3AgMBAAECggEBAKpe92kybRGr3/rhMrdCYRJJpZEP1nGUdN89QbGMxxAS\n0h84n9vRYNNXRKWxMNtVEWtoLdDpiNUP8Dv59yO1LFIen2DL2e3rDJv4Gu/YCS7F\nR0NuS+FaDIaRURYLFeV+MzyJv75jVvhbFlqByJxngcGS1KAcSApvOLTnrJSlPpy9\n8ec5gnDhdOUND9PaQt8xCqMs1RPpjqvrgRzMEodZoqT5v+b0K1GmsAdbSHNP2mLM\nrqtpFDefiM1YfsTHUtxQykxG2Ipd2jzJ0a8O0qmVqdXcP9J9aqLcmD/2/r96GEV6\n/5qvIBj3SRFobxCiCwfys2XOXfjz2J+BUZzGoZvKeRECgYEA518hT6mn46LhwrTI\nW+Qpi7iTJgOfeLC+Ng855VHVQFED1P3T2lfyfGDyqKI/wV1DJIJmO8iOXerSPnhi\nb7reQkyHj6ERUtuE+6BQ9oTw2QD3EEvzOK2PEH5UipbhVTDnC3fT62Vz2yb3tR8D\n2h0XVJkj/dng9p1Td5aDGMriRRMCgYEA10vTyYqBPjDIEYw/Sc9aQk2kT6x3hrRQ\ngR4xyuI31RTCRD/KpLh/7z4s11Wkr+F9CyASeLbqu6zymlLOlS5p7IUkJ/x2X027\nJWVY1SR+oF3iF3SHiP4XkOVvWOKwIVUhgTjK1+Di6i3AlwIeAOS7VCCP6W0gbnwJ\nyyAAHZ30NM0CgYAqTur4dj2NEqvVvtkkdIRkWEwQF3mByE//8qjTljM4n5fjysaC\nlrJwrAmzbHfcFAHDG1U2eWYPJnFrmvflFnauCPCBAyL308xtdtNXQNgJ1nNXN4wy\nQQp4KaGr9gseWOLm5fKKiPK2kFmbdSBvMgKiJZ6/PKg2cG5i39L5JaBaoQKBgApw\nqOJ7Du1fHDSNonwHzA6vCSq76Efl8olwV2XJNn/ks87vcPov4DRPxYjjpErLGm8x\nrPOhmxxitJj7Lv1Y9NX9VtWBjpPshwi3M2mSjXllVBNjGTdxat8h4RZkV7omEKvd\nfyicxSQp987a0W2lqdfYhGIDYrE43pi1AoxtHmx5AoGBAJSoRy62oZbW6vjfdkuf\nvVnjNfFZwuiPV/X2NT+BhNPe5ZKFtC6gGedHLaIBBD3ItRhGuHZxgWXccPjGHofi\n6DlPdp2NePJgDT2maSjGSiAcHxyXdmW+Ev27NblvAxktoTUcVqSENrKFb+Fh4FXN\nlXiJzOEwAXiP2ZFbMRyNF/MI\n-----END PRIVATE KEY-----\n-----BEGIN CERTIFICATE-----\nMIIDNzCCAh+gAwIBAgIJAI1Wr/fK5F0GMA0GCSqGSIb3DQEBCwUAMDIxHDAaBgNV\nBAoME29wZW5ibWMtcHJvamVjdC54eXoxEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0x\nOTAyMDExMzIyMDhaFw0yOTAxMjkxMzIyMDhaMDIxHDAaBgNVBAoME29wZW5ibWMt\ncHJvamVjdC54eXoxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\nBQADggEPADCCAQoCggEBAMKVbUI5JpvY7RZbRKBPMvFDUiCXgSlsSZMrwIBD7Aju\nWhMNnuxnBh1/rJz1MCz/I0qOUmWOB50azO9sLuw82kfgUDreRozpNsEEpNGyHBne\nbJeIE46Q4GzrDpXv5zu4Q9wwWB7r/hbVVcNF4yLTXpyc9ZmyZDIbOmY8zj1g0QNk\nF90pn+ku4Jhz0v23vTpTsWtRIZ8zuzAH6YLw0f2oyLEy5YBX1IG/NRYjqng4KY3x\nr8X7iU51s8xURSpDSEIEKMYziqaLL/k2DrLqsp4mVR2Y5JOTyiOs0Zw5cqHSdFp8\n0RAWQi6g8e3yTkH9jDYJfqzYGgbC8X6FLTf7PepVLDcCAwEAAaNQME4wHQYDVR0O\nBBYEFDDohRZ1+QlC3WdIkOAdBHXVyW/SMB8GA1UdIwQYMBaAFDDohRZ1+QlC3WdI\nkOAdBHXVyW/SMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFN0DWy6\nYPXHzidWMKKyQiJ5diqUv6LbujKOHUk+/LGSoCqcUp8NvmFDKWYP9MxjOAi9TVbs\nRGlIHBl38oSwKUayXBTY/vVeSLls90giUAOjswoRbBBQZvKyfEuFpc1zUsrhGLDC\n/6DuRt9l0DWcMcmP6Yh3jePIIwTr3bpxBGrwNLly8fPf16q4bWRIAcI3ZgLOhsrN\nLfD2kf56oYViM44d54Wa0qjuCfeTnJ46x/lo6w2kB9IzF7lwpipMU7+AG8ijDdaQ\nn8t0nADpv6tNNargLcOTTfJ0/P2PaKxwA1B88NhjlymBnNbz4epIn4T3KyysgS62\nzwqs66LPWoDerzc=\n-----END CERTIFICATE-----", "CertificateType": "PEM", "CertificateUri": { "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1" } } Change-Id: I2acbf8afa06bbf7d029d4971f7ab3b3988f5f060 Signed-off-by: Marri Devender Rao <devenrao@in.ibm.com> Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Redfish: Fix managers UUID mixupEd Tanous2019-05-131-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | In redfish, there are 3 UUIDs. 1. Service root. This is unique to Redfish, and not needed outside the service. It is generated on first startup, and persisted to nonvolatile in the bmcweb_persistent_data.json file. This is the one that is present in the ServiceRoot schema, as well as in the Systems schema under the ServiceEntryPointUUID. 2. Managers. This UUID needs to match the UUID avaialble in IPMI, using the Get Device GUID command. This is generated via the systemd sd_id128_get_machine_app_specific call, with a matching application ID in ipmi. 3. System. This UUID is generated from teh host system. In the case of Power, it comes from settingsd. In the case of x86, it comes from MDRv2. This patchset corrects a few properties to pull from the correct place, after some regressions in the last few weeks that weren't caught right away. Vernon has an oncoming patch to IPMI to correct the IPMI side of this. Signed-off-by: Ed Tanous <ed.tanous@intel.com> Change-Id: I98f3a06ba552c84142aaa749cfd199541a0ae1fd
* Redfish: Supporting ServiceRootUUID field for ↵Bernard Wong2019-05-021-23/+2
| | | | | | | | | | | | | | | | | /redfish/v1/Managers/{ManagerId}schema - Created a common utiity file called, systemd_utils.hpp to hold the function getUuid. - Added json field support for ServiceEntryPointUUID field to retrieve it from system_utils.hpp. - Amended the header file, service_root.hpp to get the uuid from the newly created system_utils.hpp file. Changes tested with QEMU emulator and Witherspoon image => Passed Redfish Validator => Passed Change-Id: If7f2aba49942a0b315fb012da29af194ebd0ea6f Signed-off-by: Bernard Wong <trials13@hotmail.com>
* bmcweb: Implement single Redfish "system" endpointEd Tanous2019-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | This commit changes the redfish behavior to move to a single, known name under the /redfish/v1/Systems/system path. This is advantageous for a lot of reasons. 1. Lots fewer dbus calls to determine the system name for every path. This could be optimized in other ways, like checking the system name on startup, but because redfish paths are not intended to be informative, this patchset takes the opinion that less code is better. 2. Lots of lowered complexity, given that each endpoint underneath /system doesn't need an individual "does this system exist, and is the name right" check. 3. This makes it possible to correctly implement the "Links" property in Chassis, which is required for the OCP base server profile Tested By: Very minimal testing done, but it seems to pass the validator. Change-Id: Iea3cb5081b92a3843b6877decd009936de00561c Signed-off-by: Ed Tanous <ed.tanous@intel.com> Signed-off-by: Gunnar Mills <gmills@us.ibm.com>
* Delete socket adaptersEd Tanous2019-02-041-1/+2
| | | | | | | | | | | | | | Boost beast, ASIO, and networking TS already have mechanisms for injecting unit tests, using template parameters. We already use this to some extent, although we pass through socket_adapters. Now that we have constexpr if, we have the ability to simplify this code quite a bit. Tested by: Pulled down phosphor-webui, ran redfish service validator. Observed no errors. Change-Id: Ib8734aeb4c9139b56705060f6196e8ae16458fe9 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Fix SessionService odata.idGunnar Mills2018-12-181-1/+1
| | | | | | | | SessionService had the wrong @odata.id. Redfish-Service-Validator found this. Change-Id: Idf67b46b69b6ad770062ea3146996d100c424eea Signed-off-by: Gunnar Mills <gmills@us.ibm.com>
* Fix missing Managers route on serviceRootEd Tanous2018-12-041-0/+1
| | | | | | | | | | Managers routing was missing on serviceroot. This resolves it. Tested By: Pulled ServiceRoot, and observed endpoint exists Change-Id: Id2ef8e0107512ee231ec0af9514f26526cb30c73 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* bmcweb: Redfish away from json cacheEd Tanous2018-11-261-15/+23
| | | | | | | | | | | | | | | | | | | | In the original incarnation of bmcweb, route registration was done automatically. This has proved to be a terrible idea, wraught with corner cases and issues. The route registration is currently the only user of the redfish::Node::json element. Unfortunately, as written, this structure consumes a lot of memory that's duplicated and not very useful. From a performance perspective, there is almost no difference between rebuilding the structure for each GET request, and having the "cache" that needs to be copied into the response and modified before it can be useful. In the programming tradeoffs for bmc, lower memory usage is more important than latency, especially at these levels. Change-Id: I785e8352123e5e886acf05cd59cb23648f93839d Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* bmcweb: fix Redfish UUIDEd Tanous2018-11-211-16/+14
| | | | | | | | | | | | | | The UUID implementation had a number of issues that weren't fleshed out, as it was built before we had the appropriate systemd support. This resolves it. Tested By: Loading the redfish ServiceRoot endpoint, and verifying the UUID is not zeros. Change-Id: I86aba678e3d492ad7d258807b0ed9e7d453667a2 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Add the Redfish message registriesJason M. Bills2018-11-161-0/+1
| | | | | | | | | | | | | | This change adds the message registries used by bmcweb. It includes the OEM OpenBMC.0.1.0 message registry and the DMTF Base.1.4.0 message registry for reference. Tested: Ran the Redfish Service Validator and got passing results for the MessageRegistryCollection and the two MessageRegsitryFiles. Change-Id: I3e5756103006f065530253b5dbc0d7720cf616b9 Signed-off-by: Jason M. Bills <jason.m.bills@linux.intel.com>
* Implement JsonSchema endpointEd Tanous2018-09-171-0/+1
| | | | | | | | | | This patchset implements JsonSchema support, and automates our update of the XML metadata, and Json schema files in the future by way of a python script. Change-Id: Iec6f580d10736678149db18d87be2f140b535be9 Signed-off-by: Ed Tanous <ed.tanous@intel.com> Signed-off-by: James Feist <james.feist@linux.intel.com>
* Move to clang-format-6.0Ed Tanous2018-09-051-46/+53
| | | | | | | | This commit moves the codebase to the lastest clang-format file from upstream, as well as clang-format-6.0. Change-Id: Ice8313468097c0c42317fbb9e10ddf036e8cff4c Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Move over to upstream c++ styleEd Tanous2018-07-261-4/+4
| | | | | | | | | | | | | | | | | | This patchset moves bmcweb over to the upstream style naming conventions for variables, classes, and functions, as well as imposes the latest clang-format file. This changeset was mostly built automatically by the included .clang-tidy file, which has the ability to autoformat and auto rename variables. At some point in the future I would like to see this in greater use, but for now, we will impose it on bmcweb, and see how it goes. Tested: Code still compiles, and appears to run, although other issues are possible and likely. Change-Id: If422a2e36df924e897736b3feffa89f411d9dac1 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Reimplement UUID based on systemd UUIDEd Tanous2018-07-261-10/+32
| | | | | | | ...rather than a randomly generated one Change-Id: I85493ac29d21f5fa9f347edc21129901f9d0d911 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Boost beastEd Tanous2018-06-291-6/+6
| | | | | | | | This commit is the beginings of attempting to transition away from crow, and toward boost::beast. Unit tests are passing, and implementation appears to be slightly faster than crow. Change-Id: Ic8d946dc7a04f514c67b1098f181eee1ced69171
* Make a few changes to privileges commitEd Tanous2018-03-271-11/+8
| | | | | | | | | | | | | | | | | | | | | | 1. Create char* overloads for the things that need it. 2. Fix up a couple errant moves 3. Use the gtest APIs for testing container membership, rather than sort 4. Move the index management to vector rather than map to avoid a lookup 5. Remove errant use of .at() 6. Move privilege comparison into the privilege class, in order to keep the bitset implementation private. This removes the requirment on the forward declaration of PrivilegeProvider, and the use of friend class 7. Remove unimplemented override strcutures. Feel free to add them back once implemented 8. Make setSignlePrivilege return a code if the set failed 9. Remove the need for an extra construction of a blank privileges object for things that require no privileges. Tested by: updating unit tests with the appropriate APIs. Relevant unit tests pass Change-Id: Ie9cde003b6c865979b4cac086379d0a3473896ce Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Redfish NetworkProtocolBorawski.Lukasz2018-03-271-1/+0
| | | | | | | Node version of the NetworkProtocol implementation. Change-Id: I6f52dca4e530917a5b815a32f1222b481059aa23 Signed-off-by: Borawski.Lukasz <lukasz.borawski@intel.com>
* Improved Refish subroutesBorawski.Lukasz2018-03-271-14/+10
| | | | | | | | | | - getSubroutes() is now a method of the Node class - getSubroutes() is called only once per node at construction time, not at each GET request - template parameter removed from the Node class Change-Id: Ie4eb8766717aae566c13c295458fe0dba8ab84c0 Signed-off-by: Borawski.Lukasz <lukasz.borawski@intel.com>
* Privilege implementation changeBorawski.Lukasz2018-03-271-3/+12
| | | | | | | | | | - privilege_registry.json has been removed - PrivilegeProvider class has been removed - default privileges for nodes are now hard-coded - privilege overriding feature is not yet implemented Change-Id: Ic9fdfa1c692c1abd26e339e2a8c702fc4aebd19f Signed-off-by: Borawski.Lukasz <lukasz.borawski@intel.com>
* Redfish privilegesBorawski.Lukasz2018-03-271-2/+2
| | | | | | | | | | | | Redfish privilege authorization subsystem controlled by the privilege_registy.json configuration file. PropertyOverrides, SubordinateOverrides and ResourceURIOverrides are not yet implemented. Change-Id: I4d5670d557f4da172460ada3512e015830dab667 Signed-off-by: Borawski.Lukasz <lukasz.borawski@intel.com> Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Service RootBorawski.Lukasz2018-01-241-0/+53
Change-Id: Ibf9d463802d77014852a92ecfcb8096324f3670f Signed-off-by: Borawski.Lukasz <lukasz.borawski@intel.com>
OpenPOWER on IntegriCloud