On Thu, Apr 30, 2020 at 12:09 PM Zhenfei Tai <ztai@google.com> wrote:

Also, with t= hat change in http_connection.h, it still accepts any client certificate pr= ovided in curl.

Here's what I did:

1. Disa= ble=C2=A0BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION

2. Uncommented s= sl_key_handler.hpp:315 and added the boost::asio::ssl::verify_fail_if_no_pe= er_cert

Behavior after change:

1. Reject= s curl without client certificate.

2. Returns when client certifi= cate matches the one authority directory.

3. Rejects when client = sends other=C2=A0certificates.=C2=A0

The change is= just for testing=C2=A0purposes, I guess the original intention was not to = mTLS every request.

On Thu, Apr 30, 2020 at 11:34 AM Zhenfei Tai <<= a href=3D"mailto:ztai@google.com" target=3D"_blank">ztai@google.com>= wrote:

Hi P.K.

I tried the same thing.=C2=A0

Could you share which url you tested?
With that c= hange, if I access the https://${bmc}/redfish/v1 url in chrome, it prompts = to choose a client certificate, but will also work if no certificate is cho= sen.

Thanks,
Zhenfei

On Thu, Apr 30, 2020 at 6= :27 AM P. K. Lee (=E6=9D=8E=E6=9F=8F=E5=AF=AC) <P.K.Lee@quantatw.com> wrote:

I found a way to fix = this issue, but it needs to be modified to the source code. In two steps:
Step 1.
The source code "adaptor.set_verify_mode(boost::asio::ssl::verify_peer= );" in http_connection.h is replaced with
"adaptor.set_verify_mode(boost::asio::ssl::verify_peer | boost::asio::= ssl::verify_fail_if_no_peer_cert);"

Step 2.
AccountService->Oem->OpenBMC->AuthMethods->TLS is set. (false b= y default)

It will enable enforce mTLS authentication.

Best,
P.K.

> -----Original Message-----
> From: Wiktor Go=C5=82gowski <wiktor.golgowski@linux.intel.com> > Sent: Saturday, April 25, 2020 1:03 AM
> To: Richard Hanley <rhanley@google.com>; Zhenfei Tai <ztai@google.com>
> Cc: open= bmc@lists.ozlabs.org; P. K. Lee (=E6=9D=8E=E6=9F=8F=E5=AF=AC) <P.K.Lee@quantatw.com>;
> jrey@linux.ibm= .com; P. K. Lee (=E6=9D=8E=E6=9F=8F=E5=AF=AC) <P.K.Lee@quantatw.com>; Joseph > Reynolds <j= rey@linux.ibm.com>
> Subject: Re: mTLS on bmcweb
>
>
>
> On 4/23/20 7:35 PM, Richard Hanley wrote:
> > My guess is that somehow the root cert used to validate clients i= sn't installed
> correctly, and so it's defaulting to basic auth.
> >
> > At least that's my reading of this review
> > https://gerrit.openbmc-project.= xyz/c/openbmc/bmcweb/+/27270
> >
>
> I think this would be the case. If the client certificate is not provi= ded, TLS
> connection is still established, just without authenticating the clien= t. This
> allows upper layer to provide other authentication methods (e.g. Basic= Auth).
> >
> > On Thu, Apr 23, 2020 at 9:47 AM Zhenfei Tai <ztai@google.com
> <mailto:ztai@g= oogle.com>> wrote:
> >
> >=C2=A0 =C2=A0 =C2=A0I guess part of my question is how to configur= e the mTLS certs to make
> it work properly.
> >
> >=C2=A0 =C2=A0 =C2=A0So far only https works (server side TLS).
> >
> >=C2=A0 =C2=A0 =C2=A0Thanks,
> >=C2=A0 =C2=A0 =C2=A0Zhenfei
> >
> >=C2=A0 =C2=A0 =C2=A0On Thu, Apr 23, 2020 at 8:50 AM Joseph Reynold= s <jrey@linux.ib= m.com
> <mailto:jre= y@linux.ibm.com>> wrote:
> >
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0On 4/23/20 5:47 AM, P. K. Lee (= =E6=9D=8E=E6=9F=8F=E5=AF=AC) wrote:
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0> Hi,
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0> I encountered the same issu= e when using Redfish to replace the
> certificate.
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0> Regardless of whether the p= arameters include --cert --key
> --cacert or only --cacert, the authentication can still succeed.
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0> Best,
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0> P.K.
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> Date: Wed, 22 Apr 2020 = 14:58:06 -0700
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> From: Zhenfei Tai <<= a href=3D"mailto:ztai@google.com" target=3D"_blank">ztai@google.com
> <mailto:ztai@g= oogle.com>>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> To: openbmc@lists.ozlabs.org
> <mailto:openbmc@lists.ozlabs.org>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> Subject: mTLS on bmcweb=
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> Message-ID:
> >
> >>=C2=A0 =C2=A0 =C2=A0 <CAMXw96Pp511sUO=3Dq1XLz2uJzh4S6D7tUwm= kvpbnq_yU-iJfiKg@
> mail.g
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> mail.com <http://mail.com>>= ;
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> Content-Type: text/plai= n; charset=3D"utf-8"
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> Hi,
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> I'm trying out bmcw= eb mTLS which should be enabled by
> default by
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>>
> https://github.com/openbmc/bmcw= eb/blob/master/CMakeLists.txt#L89
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> In my test, I created a= self signed key and certificate pair,
> stacked them
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> up into server.pem in /= etc/ssl/certs/https that bmcweb uses.
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> However when I tried to= curl bmcweb service, I was able to get
> response by
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> only supplying the cert= .
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> curl --cacert cert.pem= =C2=A0 https://${bmc}/redfish/v1
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> With the mTLS enabled, = I expected it should error out since no
> client
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> certificate is provided= .
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>>
>
> As mentioned, if you did not provide a client certificate, connection = was
> established to allow for Basic Auth. And as the Service Root requires = no
> authentication, you got a response.
>
> - Wiktor
>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> Could someone with rele= vant knowledge help with my
> question?
> >
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0I'm not sure what you are as= king.=C2=A0 Are you asking how to install
> mTLS
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0certs into the BMC and then use = them to connect?=C2=A0 I am still
> waiting for
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0documentation that describes how= to configure and use the mTLS
> feature.
> >
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0I've added an entry to the s= ecurity working group as a reminder to
> do
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0this.=C2=A0 (I don't have th= e skill to document this feature.)
> >
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- Joseph
> >
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> Thanks,
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> Zhenfei
> >