diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c075397..526aedd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -63,11 +63,15 @@ jobs: . xit eof + - name: Update the copyright year + run: | + find . -type f -exec sed -i -E 's/Copyright [0-9\-]+ DMTF/Copyright 2017-'$(date +'%Y')' DMTF/' {} \; + find . -type f -exec sed -i -E 's/Copyright \(c\) [0-9\-]+,/Copyright (c) 2017-'$(date +'%Y')',/' {} \; - name: Commit and push the updates run: | git config user.name "GitHub Release Workflow" git config user.email "<>" - git add CHANGELOG.md setup.py redfish_interop_validator/RedfishInteropValidator.py + git add * git commit -s -m "${{github.event.inputs.version}} versioning" git push origin main - name: Make the release diff --git a/README.md b/README.md index 7b9297f..9a780d3 100644 --- a/README.md +++ b/README.md @@ -51,42 +51,42 @@ Modify the config\example.ini file to enter the system details under below secti ### [Tool] -| Variable | Type | Definition | -| :--- | :--- | :--- | -| Version | string | Internal config version (optional) | -| Copyright | string | _DMTF_ copyright (optional) | -| verbose | int | level of verbosity (0-3) | +| Variable | CLI Argument | Type | Definition | +| :--- | :--- | :--- | :--- | +| `verbose` | `-v` | integer | Verbosity of tool in stdout; 0 to 3, 3 being the greatest level of verbosity. | ### [Interop] -| Variable | Type | Definition | -| :--- | :--- | :--- | -| Profile | string | name of the testing profile (mandatory) | -| Schema | string | name of json schema to test profile against | +Note: These arguments are only supplied via the CLI to the tool and are not specified in the configuration file. + +| CLI Argument | Type | Definition | +| :--- | :--- | :--- | +| `profile` | string | The name of the testing profile (mandatory). | +| `--schema` | string | The filepath and name of the schema file to verify the format of the profile. | ### [Host] -| Variable | Type | Definition | -| :--- | :--- | :--- | -| ip | string | Host of testing system, formatted as https:// ip : port (can use http as well) | -| username | string | Username for Basic authentication | -| password | string | Password for Basic authentication (removed from logs) | -| description | string | Description of system being tested (optional) | -| forceauth | boolean | Force authentication even on http servers | -| authtype | string | Authorization type (Basic | Session | Token | None) | -| token | string | Token string for Token authentication | +| Variable | CLI Argument | Type | Definition | +| :--- | :--- | :--- | :--- | +| `ip` | `-r` | string | The address of the Redfish service (with scheme); example: 'https://123.45.6.7:8000'. | +| `username` | `-u` | string | The username for authentication. | +| `password` | `-p` | string | The password for authentication. | +| `description` | `--description` | string | The description of the system for identifying logs; if none is given, a value is produced from information in the service root. | +| `forceauth` | `--forceauth` | boolean | Force authentication on unsecure connections; 'True' or 'False'. | +| `authtype` | `--authtype` | string | Authorization type; 'None', 'Basic', 'Session', or 'Token'. | +| `token` | `--token` | string | Token when 'authtype' is 'Token'. | ### [Validator] -| Variable | Type | Definition | -| :--- | :--- | :--- | -| payload | string | Option to test a specific payload or resource tree (see below) | -| logdir | string | Place to save logs and run configs | -| oemcheck | boolean | Whether to check Oem items on service | -| online_profiles | boolean | Whether to download online profiles | -| debugging | boolean | Whether to print debug to log | -| required_profiles_dir | string | Option to set the root folder of required profiles | -| collectionlimit | string | Sets a limit to links gathered from collections by type, e.g. `ComputerSystem 20` limits ComputerSystemCollection to 20 links | +| Variable | CLI Argument | Type | Definition | +| :--- | :--- | :--- | :--- | +| `payload` | `--payload` | string | The mode to validate payloads ('Tree', 'Single', 'SingleFile', or 'TreeFile') followed by resource/filepath; see below. | +| `logdir` | `--logdir` | string | The directory for generated report files; default: 'logs'. | +| `oemcheck` | `--nooemcheck` | boolean | Whether to check OEM items on service; 'True' or 'False'. | +| `online_profiles` | `--no_online_profiles` | boolean | Whether to download online profiles; 'True' or 'False'. | +| `debugging` | `--debugging` | boolean | Output debug statements to text log, otherwise it only uses INFO; 'True' or 'False'. | +| `required_profiles_dir` | `--required_profiles_dir` | string | Option to set the root folder of required profiles | +| `collectionlimit` | `--collectionlimit` | string | Sets a limit to links gathered from collections by type (schema name).
Example 1: `ComputerSystem 20` limits ComputerSystemCollection to 20 links.
Example 2: `ComputerSystem 20 LogEntry 10` limits ComputerSystemCollection to 20 links and LogEntryCollection to 10 links. | ### Payload options diff --git a/SelfSignedCerts.md b/SelfSignedCerts.md deleted file mode 100644 index a0e70e1..0000000 --- a/SelfSignedCerts.md +++ /dev/null @@ -1,100 +0,0 @@ -Copyright 2018 DMTF. All rights reserved. - -# Self-signed Certificate Walkthrough - - -## Introduction - -The Redfish Service Validator (as well as several of the other tools in the [DMTF github organization](https://github.com/DMTF)) use the `requests` Python package for sending HTTP requests to a Redfish service. The `requests` package provides a feature to facilitate communicating with services that are protected with a server certificate that is self-signed or signed by a certificate authority (CA) that is not included in standard CA bundles. - -Users of the Redfish Service Validator can make use this feature by specifying their own certificate bundle via the `--ca_bundle` command-line parameter: - -``` ---ca_bundle CA_BUNDLE path to Certificate Authority bundle file or directory -``` - -The bundle can also be specified via the `CertificateBundle = CA_BUNDLE` option in the `config.ini` file. - -While specifying the bundle to use is quite simple, creating the bundle to be used can be more challenging. This document provides one possible set of steps to create a bundle for use with the Redfish Service Validator (or any other tool/code that takes a certificate bundle as an option). - -## Steps - -Steps to create a certificate bundle directory that works with the [verify=CA_BUNDLE option](http://docs.python-requests.org/en/master/user/advanced/#ssl-cert-verification) in the python `requests` library: - -The steps below use a couple of commands from the openssl package. If it's not already installed on your system, go ahead and find and install it. - -The steps here also assume you already have a Redfish service up and running that uses a self-signed cert. - -**Step 1.** Get the certificate for your service into a PEM format file. - -If you were the one that generated your self-signed cert, you may already have this at hand. But if not, you can get it from the running service using openssl. Run this openssl command, substituting the proper IP address and port for your service: - -``` -$ openssl s_client -connect : -showcerts -``` - -This will generate a couple (or a few) screenfuls of output. Scroll back through the output and look for a block of text that begins with "-----BEGIN CERTIFICATE-----" and ends with "-----END CERTIFICATE-----". Copy that text (including the "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" lines) and paste them into a text file. Name the text file with a '.pem' extension, for example, `myhost.pem`. - -**Step 2.** Place the file into a directory you will use for your ca_bundle directory for self-signed certs. - -For this example, I'll use a directory called `/tmp/ca_certs` and a PEM file called `myhost.pem` (from Step 1). - -``` -$ mkdir /tmp/ca_certs -$ cp myhost.pem /tmp/ca_certs/ -$ ls /tmp/ca_certs/ -myhost.pem -``` - -**Step 3.** Rehash the ca_certs directory. - -This is the step that makes your ca_certs directory recognized as a CA_BUNDLE directory that can be used by various runtimes to validate server certificates. - -``` -$ c_rehash /tmp/ca_certs/ -Doing /tmp/ca_certs/ -$ ls /tmp/ca_certs/ -889897a9.0 myhost.pem -``` - -You'll notice that now an additional file has been added to your `/tmp/ca_certs` directory. The name of the file is a based on a hash of the public cert in the .pem file. - -Note: If you have additional server certificates that you want to add to the bundle of trusted certs, simply repeat steps 1, 2 and 3 for each server certificate. They can all go into the same ca_certs bundle directory. - -**Step 4.** You _may_ need to perform this step depending on whether the hostname where your service is running matches the `CN` or one of the `Subject Alternative Name` values in your certificate. - -Rerun the openssl command from Step 1 that displays the contents of your certificate. Look through the output for the `Subject Alternative Name` values (if present) or the `CN` (Common Name) value. You want to be sure the hostname you use to access the service matches one of those names. - -For example, let's assume your certificate has a `CN` value of `CN=idrac`. Example: - -``` -$ openssl s_client -connect : -showcerts -CONNECTED(00000003) -depth=0 C = US, ST = New York, L = Metropolis, O = Acme Inc., OU = Remote Access Group, CN = idrac, emailAddress = info@example.com -... -``` - -You would want to be sure you specify a hostname of `idrac` when accessing the service. If that is already the correct hostname for your service, you don't need to perform this step. But if not, you may need to create an entry in your local /etc/hosts file (or equivalent) to map the IP address of your service to that hostname. - -So, if the CN looks like 'CN=idrac' and the IP address of your service is 127.0.0.1, add an entry like this to your /etc/hosts: - -``` -127.0.0.1 idrac -``` - -**Step 5.** Use the new ca_certs directory - -You should now be able to use the new ca_certs dir you created with the Redfish Service Validator tool like this: - -``` -$ python3 RedfishServiceValidator.py -i idrac --authtype Basic -u -p --ca_bundle /tmp/ca_certs --payload Single /redfish/v1/Systems -``` - -Or in another python program using the `requests` library like this: - -``` -r = requests.get('https://idrac/redfish/v1', verify='/tmp/ca_certs') -``` - - - \ No newline at end of file diff --git a/config/example.ini b/config/example.ini index b81cd57..f0f5ef4 100644 --- a/config/example.ini +++ b/config/example.ini @@ -1,6 +1,4 @@ [Tool] -Version = 2 -Copyright = Redfish DMTF (c) 2021 verbose = [Host] @@ -19,4 +17,3 @@ oemcheck = True online_profiles = True debugging = False collectionlimit = LogEntry 20 - diff --git a/redfish_interop_validator/config.py b/redfish_interop_validator/config.py index e031b37..2e534ca 100644 --- a/redfish_interop_validator/config.py +++ b/redfish_interop_validator/config.py @@ -49,7 +49,7 @@ def convert_config_to_args(args, config): if option.lower() not in ['version', 'copyright']: my_logger.error('Option {} not supported!'.format(option)) elif my_config[section][option] not in ['', None]: - if option.lower() == 'payload': + if option.lower() == 'payload' or option.lower() == 'collectionlimit': setattr(args, option, my_config[section][option].split(' ')) else: setattr(args, option, my_config[section][option])