commit	fff6a4d34a9a49f9e1e228ffb3afb5385be2a4ad	[log] [tgz]
author	Abhishek Patel <Abhishek.Patel@ibm.com>	Wed Jul 21 11:29:45 2021 -0500
committer	Myung Bae <myungbae@us.ibm.com>	Fri Jul 11 15:34:56 2025 +0000
tree	39a030111b8274a4bfd564a030cf511a9baee88a
parent	39fe3af2cd21cb023da0701477e2f83e1cb5003c [diff]

Add SubordinateOverrides & Fix Log_services privileges

SubordinateOverrides:
  This commit automates the creation of SubordinateOverrides privileges
  structures from the redfish privilege registry. In addition, it
  enhances the function of parse_registries.py.

  It reads SubordinateOverrides privilege registry from DMTF and
  generates const defines SubordinateOverrides for all the privilege
  registry entries in the same format that the Privileges struct
  accepts.

  Moreover, it generates unique const defines for all
  SubordinateOverrides target levels.
  Ex: EthernetInterface SubordinateOverrides has two "Targets":
      ["Manager", "EthernetInterfaceCollection"]. So
      parse_registries.py generates two unique const

      1) Subordinate override for Manager -> EthernetInterface
      2) Subordinate override for Manager ->
         EthernetInterfaceCollection ->  EthernetInterface

  Note: if SubordinateOverrides privilege gets changed, then it
  automatically updates that route privilege, but if
  SubordinateOverrides target gets changed, then the user needs to
  update that manually.

Fix Log_services privileges:
  In Log_services, some of the privileges not following the
  Redfish_1.1.0_PrivilegeRegistry registry.

  This commit contains the following LogServices privileges.

  1) POST method
```
     ComputerSystem -> LogServiceCollection -> LogService
      - POST /redfish/v1/Systems/<str>/LogServices/EventLog/Actions/LogService.ClearLog/
      - POST /redfish/v1/Systems/<str>/LogServices/Dump/Actions/LogService.CollectDiagnosticData/
      - POST /redfish/v1/Systems/<str>/LogServices/Dump/Actions/LogService.ClearLog/
      - POST /LogServices/PostCodes/Actions/LogService.ClearLog/
```

   2) DELETE method
```
     ComputerSystem -> LogServiceCollection -> LogService -> LogEntryCollection -> LogEntry
       - DELETE /redfish/v1/Systems/<str>/LogServices/EventLog/Entries/<str>/
```

This commit also changes the current privilege

   1) ConfigureManager to ConfigureComponents.

```
    DELETE /redfish/v1/Systems/<str>/LogServices/EventLog/Entries/<str>
```

   2) ConfigureCompnents -> ConfigureManager

```
   POST /redfish/v1/Systems/<str>/LogServices/Dump/Actions/LogService.ClearLog/
   POST /redfish/v1/Systems/<str>/LogServices/EventLog/Actions/LogService.ClearLog/
   POST /redfish/v1/Systems/<str>/LogServices/Dump/Actions/LogService.CollectDiagnosticData/
```

Tested: manually tested on Witherspoon system, there is no change in
        output. Run Redfish validator, with all different Privileges;
        Error Get: UUID: String '' does not match pattern ''
        this commit doesn't affect UUID

Email sent to openbmc list:
https://lists.ozlabs.org/pipermail/openbmc/2021-August/027232.html

Change-Id: I37d8a2882f1cfaa59a482083f180fdd0805e2e7d
Signed-off-by: Abhishek Patel <Abhishek.Patel@ibm.com>
Signed-off-by: Myung Bae <myungbae@us.ibm.com>

4 files changed

tree: 39a030111b8274a4bfd564a030cf511a9baee88a

README.md

OpenBMC webserver

This component attempts to be a "do everything" embedded webserver for OpenBMC.

Features

The webserver implements a few distinct interfaces:

DBus event websocket. Allows registering on changes to specific dbus paths, properties, and will send an event from the websocket if those filters match.
OpenBMC DBus REST api. Allows direct, low interference, high fidelity access to dbus and the objects it represents.
Serial: A serial websocket for interacting with the host serial console through websockets.
Redfish: A protocol compliant, DBus to Redfish translator.
KVM: A websocket based implementation of the RFB (VNC) frame buffer protocol intended to mate to webui-vue to provide a complete KVM implementation.

Protocols

bmcweb at a protocol level supports http and https. TLS is supported through OpenSSL. Http1 and http2 are supported using ALPN registration for TLS connections and h2c upgrade header for http connections.

AuthX

Authentication

Bmcweb supports multiple authentication protocols:

Basic authentication per RFC7617
Cookie based authentication for authenticating against webui-vue
Mutual TLS authentication based on OpenSSL
Session authentication through webui-vue
XToken based authentication conformant to Redfish DSP0266

Each of these types of authentication is able to be enabled or disabled both via runtime policy changes (through the relevant Redfish APIs) or via configure time options. All authentication mechanisms supporting username/password are routed to libpam, to allow for customization in authentication implementations.

Authorization

All authorization in bmcweb is determined at routing time, and per route, and conform to the Redfish PrivilegeRegistry.

*Note: Non-Redfish functions are mapped to the closest equivalent Redfish privilege level.

Configuration

bmcweb is configured per the meson build files. Available options are documented in meson_options.txt

Compile bmcweb with default options

meson setup builddir
ninja -C builddir

If any of the dependencies are not found on the host system during configuration, meson will automatically download them via its wrap dependencies mentioned in bmcweb/subprojects.

Use of persistent data

bmcweb relies on some on-system data for storage of persistent data that is internal to the process. Details on the exact data stored and when it is read/written can seen from the persistent_data namespace.

TLS certificate generation

When SSL support is enabled and a usable certificate is not found, bmcweb will generate a self-signed a certificate before launching the server. Please see the bmcweb source code for details on the parameters this certificate is built with.

Redfish Aggregation

bmcweb is capable of aggregating resources from satellite BMCs. Refer to AGGREGATION.md for more information on how to enable and use this feature.