commit 250b0ebb0e8d55882fa8e6b156f88828a7ba185d
author Przemyslaw Czarnowski <przemyslaw.hawrylewicz.czarnowski@intel.com> Mon Feb 24 10:23:56 2020 +0100
committer Przemyslaw Czarnowski <przemyslaw.hawrylewicz.czarnowski@intel.com> Thu Mar 05 08:42:23 2020 +0000
tree 146596763a6cc809899e0d931fe0f6bd6012760b
parent 363c23022eb3fb0cde577405e8a084a2e819b642

Permission check for virtual media proxy mode

This patch enables checking of user permission for proxy mode, as start of
this kind service is not triggered by redfish (which has permission check by
default).
Permission check is done in .onopen handler of websocket. For this reason
another dbus call for user privileges is added to verify if user has
"ConfigureManager" privilege.

I have chosen this approach, as generic privilege check for all websockets
introduces significant changes in connection upgrade flow which makes
implementaion vague and caused some memory issues difficult to track down.

It is worth noting that other websockets (eg. kvm) uses .required()
function to set privilege but this information is lost during connection
upgrade and is not checked anywhere in upgrade flow.

Tested:
Manual tests with opening websockets via web browser and dedicated nbd proxy
utility. For users with/without appropriate permissions.
Single request and burst of requests has been tested as well.

Change-Id: I2a56bec606fa0e5f3d4232e48794c9055bf6095e
Signed-off-by: Przemyslaw Czarnowski <przemyslaw.hawrylewicz.czarnowski@intel.com>

http/websocket.h

diff --git a/http/websocket.h b/http/websocket.h
index f7c818e..c467d25 100644
--- a/http/websocket.h
+++ b/http/websocket.h
@@ -23,6 +23,9 @@
     explicit Connection(const crow::Request& reqIn) :
         req(reqIn.req), userdataPtr(nullptr){};
 
+    explicit Connection(const crow::Request& reqIn, std::string user) :
+        req(reqIn.req), userName{std::move(user)}, userdataPtr(nullptr){};
+
     virtual void sendBinary(const std::string_view msg) = 0;
     virtual void sendBinary(std::string&& msg) = 0;
     virtual void sendText(const std::string_view msg) = 0;
@@ -40,10 +43,16 @@
         return userdataPtr;
     }
 
+    const std::string& getUserName() const
+    {
+        return userName;
+    }
+
     boost::beast::http::request<boost::beast::http::string_body> req;
     crow::Response res;
 
   private:
+    std::string userName{};
     void* userdataPtr;
 };
 
@@ -58,7 +67,7 @@
             message_handler,
         std::function<void(Connection&, const std::string&)> close_handler,
         std::function<void(Connection&)> error_handler) :
-        Connection(reqIn),
+        Connection(reqIn, reqIn.session->username),
         ws(std::move(adaptorIn)), inString(), inBuffer(inString, 131088),
         openHandler(std::move(open_handler)),
         messageHandler(std::move(message_handler)),