Permit assignment the IPMI management channel via JSON
phosphor-ipmi-host hard codes Channel 1 as the LAN NIC responsible for
managing and updating IPMI, Redfish, and web server access
permissions. Systems that do not have an lan-802.3 channel type
configured for IPMI Channel 1 have no way of assigning permissions
that flow to phosphor-user-manager. The inability to update
permissions within phosphor-user-manaager ultimaltely flows to Redfish
and HTTPS access.
The changes in this commit provide flexibility in assigning the IPMI
channel used to propagate permission changes to
phosphor-user-manager. A new boolean keyword, is_managment_nic, is
added. This entry is added to the JSON file, channel_config.json by
default, to announce which lan-802.3 IPMI channel is to be used to
assign IPMI permissions used by phosphor-user-manager. Only one
channel can have this ability. If the keyword is missing in the JSON
file, the code falls back to using Channel 1.
Tested:
Fully testing this change requires using code that dynamically
disables Channel 1. The SUT only has a single NIC, which is not
assigned to Channel 1.
Fully reprogrammed SPI to enter a pristine state.
Created a new user, channel 3, id 2, privilege=4
Confirmed LAN "ipmitool raw 6 1" succeeds
Confirmed Web access to new user account
Confirmed Redfish acess to new user account
Confirmed BMC console "ipmitool raw 6 1" succeeds
Used BMC console ipmitool to change user permissions from 4 to
15 (i.e. no access)
Confirmed LAN "ipmitool raw 6 1" succeeds
Confirmed Web access to new user account fails
Confirmed Redfish acess to new user account fails
Confirmed BMC console "ipmitool raw 6 1" fails
Used BMC console ipmitool to change user permissions from 15 to
4 (i.e. admin)
All of the prior tests work as expected.
Change-Id: I5f6941fefc4f80742e404de1f22ba10cbedf5d5d
Signed-off-by: Johnathan Mantey <johnathanx.mantey@intel.com>
diff --git a/user_channel/channel_mgmt.hpp b/user_channel/channel_mgmt.hpp
index 0c31338..0f35816 100644
--- a/user_channel/channel_mgmt.hpp
+++ b/user_channel/channel_mgmt.hpp
@@ -64,6 +64,7 @@
ChannelInfo chInfo;
ChannelAccessData chAccess;
size_t maxTransferSize;
+ bool isManagementNIC;
};
class ChannelConfig;
@@ -235,6 +236,14 @@
*/
int writeChannelVolatileData();
+ /** @brief Returns the IPMI channel ID authorized to push IPMI privilege
+ * changes to phosphor-user-manager. Any channel access changes made on
+ * any other channel are ignored.
+ *
+ * @return IPMI channel ID as defined in channel_config.json
+ */
+ uint8_t getManagementNICID();
+
private:
uint32_t signalFlag = 0;
std::unique_ptr<boost::interprocess::named_recursive_mutex> channelMutex{