tree 64cca46a4112de93351555b4b46799a4d96c7261
parent ce9694379a3d495b8e0719990050856642a212fe
author AppaRao Puli <apparao.puli@intel.com> 1656371343 +0000
committer Ed Tanous <edtanous@google.com> 1661291252 -0700

Add SSL support for http_client (EventService)

This commit adds the initial SSL support for http_client which can be
used for sending asynchronous Events/MetricReports to subscribed Event
Listener servers over secure channel.

Current implementation of http client only works for http protocol.
With current implementation, http client can be configured to work
with secure http (HTTPS). As part of implementation it adds the SSL
handshake mechanism and enforces the peer ceritificate verification.

The http-client uses the cipher suites which are supported by mozilla
browser and as recommended by OWASP. For better security enforcement
its disables the SSLv2, SSLv3, TLSv1, TLSv1.1 as described in below
OWASP cheetsheet.

It is validated with RootCA certificate(PEM) for now. Adding support
for different certificates can be looked in future as need arises.

[1]: https://cheatsheetseries.owasp.org/cheatsheets/TLS_Cipher_String_Cheat_Sheet.html

Tested:
 - Created new subscription with SSL destination(https) and confirmed
   that events are seen on EventListener side.
   URI: /redfish/v1/EventService/Subscriptions
   Method: POST
   Body:
   {
     "Context": "CustomText",
     "Destination": "https://<IP>:4000/service/collector/event_logs",
     "EventFormatType": "Event",
     "DeliveryRetryPolicy": "RetryForever",
     "Protocol": "Redfish"
   }

 - Unit tested the non-SSL connection by disabling the check in code
   (Note: EventService blocks all Non-SSL destinations). Verified that
   all events are properly shown on EventListener.
   URI: /redfish/v1/EventService/Subscriptions
   Method: POST
   Body:
   {
     "Context": "CustomText",
     "Destination": "http://<IP>:4001/service/collector/event_logs",
     "EventFormatType": "Event",
     "Protocol": "Redfish"
   }

 - Combined above two tests and verified both SSL & Non-SSL work fine in
   congention.

 - Created subscription with different URI paths on same IP, Port and
   protocol and verified that events sent as expected.

Change-Id: I13b2fc942c9ce6c55cd7348aae1e088a3f3d7fd9
Signed-off-by: AppaRao Puli <apparao.puli@intel.com>
Signed-off-by: Ed Tanous <edtanous@google.com>