Merge pull request #23 from OpenCHAMI/add-cacerts

Changed cert flags and added cert for gofish

cmd/collect.go

@@ -41,17 +41,17 @@ var collectCmd = &cobra.Command{
 			threads = mathutil.Clamp(len(probeStates), 1, 255)
 		}
 		q := &magellan.QueryParams{
-			User:          user,
+			User:        user,
-			Pass:          pass,
+			Pass:        pass,
-			Protocol:      protocol,
+			Protocol:    protocol,
-			Drivers:       drivers,
+			Drivers:     drivers,
-			Preferred:     preferredDriver,
+			Preferred:   preferredDriver,
-			Timeout:       timeout,
+			Timeout:     timeout,
-			Threads:       threads,
+			Threads:     threads,
-			Verbose:       verbose,
+			Verbose:     verbose,
-			WithSecureTLS: withSecureTLS,
+			CaCertPath:  cacertPath,
-			OutputPath:    outputPath,
+			OutputPath:  outputPath,
-			ForceUpdate:   forceUpdate,
+			ForceUpdate: forceUpdate,
 		}
 		magellan.CollectAll(&probeStates, l, q)
 
@@ -74,7 +74,6 @@ func init() {
 	collectCmd.PersistentFlags().BoolVar(&forceUpdate, "force-update", false, "set flag to force update data sent to SMD ")
 	collectCmd.PersistentFlags().StringVar(&preferredDriver, "preferred-driver", "ipmi", "set the preferred driver to use")
 	collectCmd.PersistentFlags().StringVar(&ipmitoolPath, "ipmitool.path", "/usr/bin/ipmitool", "set the path for ipmitool")
-	collectCmd.PersistentFlags().BoolVar(&withSecureTLS, "secure-tls", false, "enable secure TLS")
+	collectCmd.PersistentFlags().StringVar(&cacertPath, "ca-cert", "", "path to CA cert. (defaults to system CAs; used with --secure-tls=true)")
-	collectCmd.PersistentFlags().StringVar(&certPoolFile, "cert-pool", "", "path to CA cert. (defaults to system CAs; used with --secure-tls=true)")
 	rootCmd.AddCommand(collectCmd)
 }

cmd/root.go

@@ -14,8 +14,7 @@ var (
 	ports           []int
 	hosts           []string
 	protocol        string
-	withSecureTLS   bool
+	cacertPath      string
-	certPoolFile    string
 	user            string
 	pass            string
 	dbpath          string

cmd/update.go

@@ -28,15 +28,14 @@ var updateCmd = &cobra.Command{
 			Component:        component,
 			TransferProtocol: transferProtocol,
 			QueryParams: magellan.QueryParams{
-				Drivers:       []string{"redfish"},
+				Drivers:   []string{"redfish"},
-				Preferred:     "redfish",
+				Preferred: "redfish",
-				Protocol:      protocol,
+				Protocol:  protocol,
-				Host:          host,
+				Host:      host,
-				User:          user,
+				User:      user,
-				Pass:          pass,
+				Pass:      pass,
-				Timeout:       timeout,
+				Timeout:   timeout,
-				Port:          port,
+				Port:      port,
-				WithSecureTLS: withSecureTLS,
 			},
 		}
 
@@ -76,7 +75,6 @@ func init() {
 	updateCmd.Flags().StringVar(&firmwareUrl, "firmware-url", "", "set the path to the firmware")
 	updateCmd.Flags().StringVar(&firmwareVersion, "firmware-version", "", "set the version of firmware to be installed")
 	updateCmd.Flags().StringVar(&component, "component", "", "set the component to upgrade")
-	updateCmd.Flags().BoolVar(&withSecureTLS, "secure-tls", false, "enable secure TLS")
 	updateCmd.Flags().BoolVar(&status, "status", false, "get the status of the update")
 	rootCmd.AddCommand(updateCmd)
 }

internal/collect.go

@@ -35,25 +35,25 @@ const (
 
 // NOTE: ...params were getting too long...
 type QueryParams struct {
-	Host          string
+	Host         string
-	Port          int
+	Port         int
-	Protocol      string
+	Protocol     string
-	User          string
+	User         string
-	Pass          string
+	Pass         string
-	Drivers       []string
+	Drivers      []string
-	Threads       int
+	Threads      int
-	Preferred     string
+	Preferred    string
-	Timeout       int
+	Timeout      int
-	WithSecureTLS bool
+	CaCertPath   string
-	CertPoolFile  string
+	Verbose      bool
-	Verbose       bool
+	IpmitoolPath string
-	IpmitoolPath  string
+	OutputPath   string
-	OutputPath    string
+	ForceUpdate  bool
-	ForceUpdate   bool
+	AccessToken  string
-	AccessToken   string
 }
 
 func NewClient(l *log.Logger, q *QueryParams) (*bmclib.Client, error) {
+
 	tr := &http.Transport{
 		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 	}
@@ -75,9 +75,9 @@ func NewClient(l *log.Logger, q *QueryParams) (*bmclib.Client, error) {
 	}
 
 	// only work if valid cert is provided
-	if q.WithSecureTLS && q.CertPoolFile != "" {
+	if q.CaCertPath != "" {
 		pool := x509.NewCertPool()
-		data, err := os.ReadFile(q.CertPoolFile)
+		data, err := os.ReadFile(q.CaCertPath)
 		if err != nil {
 			return nil, fmt.Errorf("could not read cert pool file: %v", err)
 		}
@@ -557,10 +557,12 @@ func CollectProcessors(q *QueryParams) ([]byte, error) {
 }
 
 func connectGofish(q *QueryParams) (*gofish.APIClient, error) {
-	config := makeGofishConfig(q)
+	config, err := makeGofishConfig(q)
+	if err != nil {
+		return nil, fmt.Errorf("failed to make gofish config: %v", err)
+	}
 	c, err := gofish.Connect(config)
 	if err != nil {
-
 		return nil, fmt.Errorf("could not connect to redfish endpoint: %v", err)
 	}
 	if c != nil {
@@ -574,15 +576,42 @@ func connectGofish(q *QueryParams) (*gofish.APIClient, error) {
 	return c, err
 }
 
-func makeGofishConfig(q *QueryParams) gofish.ClientConfig {
+func makeGofishConfig(q *QueryParams) (gofish.ClientConfig, error) {
-	url := baseRedfishUrl(q)
+	var (
+		client = &http.Client{}
+		url    = baseRedfishUrl(q)
+		config = gofish.ClientConfig{
+			Endpoint:            url,
+			Username:            q.User,
+			Password:            q.Pass,
+			Insecure:            q.CaCertPath == "",
+			TLSHandshakeTimeout: q.Timeout,
+			HTTPClient:          client,
+			// MaxConcurrentRequests: int64(q.Threads),  // NOTE: this was added in latest gofish
+		}
+	)
+	if q.CaCertPath != "" {
+		cacert, err := os.ReadFile(q.CaCertPath)
+		if err != nil {
+			return config, fmt.Errorf("failed to read CA cert file: %v", err)
+		}
+		certPool := x509.NewCertPool()
+		certPool.AppendCertsFromPEM(cacert)
+		client.Transport = &http.Transport{
+			TLSClientConfig: &tls.Config{
+				RootCAs: certPool,
+			},
+		}
+	}
 	return gofish.ClientConfig{
 		Endpoint:            url,
 		Username:            q.User,
 		Password:            q.Pass,
-		Insecure:            !q.WithSecureTLS,
+		Insecure:            q.CaCertPath == "",
 		TLSHandshakeTimeout: q.Timeout,
-	}
+		HTTPClient:          client,
+		// MaxConcurrentRequests: int64(q.Threads),  // NOTE: this was added in latest gofish
+	}, nil
 }
 
 func makeRequest[T any](client *bmclib.Client, fn func(context.Context) (T, error), timeout int) ([]byte, error) {